Bug 1112418 (CVE-2014-4607) - CVE-2014-4607 lzo: lzo1x_decompress_safe() integer overflow
Summary: CVE-2014-4607 lzo: lzo1x_decompress_safe() integer overflow
Status: CLOSED ERRATA
Alias: CVE-2014-4607
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20140626,repor...
Keywords: Security
Depends On: 1131795 1112539 1112540 1112541 1112542 1112927 1112928 1113874 1113875 1131789 1131790 1131791 1131792 1131793 1131794 1131796 1132282
Blocks: 1112414
TreeView+ depends on / blocked
 
Reported: 2014-06-23 22:55 UTC by Kurt Seifried
Modified: 2019-05-31 10:08 UTC (History)
33 users (show)

(edit)
An integer overflow flaw was found in the way the lzo library decompressed certain archives compressed with the LZO algorithm. An attacker could create a specially crafted LZO-compressed input that, when decompressed by an application using the lzo library, would cause that application to crash or, potentially, execute arbitrary code.
Clone Of:
(edit)
Last Closed: 2014-07-10 04:35:18 UTC


Attachments (Terms of Use)
Backported patch (13.53 KB, patch)
2014-06-30 12:46 UTC, Jaroslav Škarvada
no flags Details | Diff
Backported patch (7.22 KB, patch)
2014-06-30 16:40 UTC, Jaroslav Škarvada
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:0861 normal SHIPPED_LIVE Moderate: lzo security update 2014-07-09 20:38:41 UTC

Description Kurt Seifried 2014-06-23 22:55:47 UTC
Don A. Bailey of securitymouse.com reports:

Vulnerability Description
-------------------------
An integer overflow may occur when processing any variant of a "literal run"
in the lzo1x_decompress_safe function. Each of these three locations is 
subject to an integer overflow when processing zero bytes. 

This exposes the code that copies literals to memory corruption.

It should be noted that if the target is 64bit liblzo2, the overflow is still
possible, but impractical. An overflow would require so much input data that
an attack would be infeasible even in modern computers.

This issue is LAZARUS.1

Comment 4 Vincent Danen 2014-06-27 02:47:36 UTC
This is now public:

http://seclists.org/oss-sec/2014/q2/665

Comment 5 Murray McAllister 2014-06-27 06:12:52 UTC
Created lzo tracking bugs for this issue:

Affects: fedora-all [bug 1113874]
Affects: epel-5 [bug 1113875]

Comment 7 Huzaifa S. Sidhpurwala 2014-06-27 09:01:15 UTC
This issue affects the version of lzo as shipped with Red Hat Enterprise Linux 6. 

Red Hat Enterprise Linux 7 only support 64-bit architectures. Since exploiting this issue on 64-bit platforms is not feasible given the amount of input data that is necessary to trigger the integer overflow, we are currently not planning planning to fix this issue in Red Hat Enterprise Linux 7.

Comment 8 Huzaifa S. Sidhpurwala 2014-06-30 04:51:34 UTC
This issue is fixed in lzo-2.0.7. Upstream mentions the following on its website:

Fixed a potential integer overflow condition in the "safe" decompressor variants which could result in a possible buffer overrun when processing maliciously crafted compressed input data.

POTENTIAL SECURITY ISSUE. CVE-2014-4607. All users are recommended to upgrade immediately.

Fortunately this issue only affects 32-bit systems and also can only happen if you use uncommonly huge buffer sizes where you have to decompress more than 16 MiB (> 2^24 bytes) untrusted compressed bytes within a single function call, so the practical implications are limited.

Also I personally do not know about any client program that uses such a huge logical block size and actually is affected.

http://www.oberhumer.com/opensource/lzo/#news

Comment 9 Jaroslav Škarvada 2014-06-30 12:46:49 UTC
Created attachment 913398 [details]
Backported patch

Backport from lzo-2.07.

Comment 10 Jaroslav Škarvada 2014-06-30 16:40:41 UTC
Created attachment 913482 [details]
Backported patch

Comment 15 Martin Prpič 2014-07-03 12:08:25 UTC
Acknowledgements:

Red Hat would like to thank Don A. Bailey from Lab Mouse Security for reporting this issue.

Comment 16 Martin Prpič 2014-07-04 08:55:26 UTC
IssueDescription:

An integer overflow flaw was found in the way the lzo library decompressed certain archives compressed with the LZO algorithm. An attacker could create a specially crafted LZO-compressed input that, when decompressed by an application using the lzo library, would cause that application to crash or, potentially, execute arbitrary code.

Comment 17 errata-xmlrpc 2014-07-09 11:21:33 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2014:0861 https://rhn.redhat.com/errata/RHSA-2014-0861.html

Comment 18 Murray McAllister 2014-08-04 06:49:35 UTC
The kdenetwork package may be affected, as it includes krfb:

http://www.kde.org/info/security/advisory-20140803-1.txt

Comment 20 Fedora Update System 2014-08-16 00:26:53 UTC
krfb-4.13.3-4.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 21 Fedora Update System 2014-08-16 00:29:01 UTC
krfb-4.11.5-3.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 22 Murray McAllister 2014-08-20 05:27:50 UTC
Created remmina tracking bugs for this issue:

Affects: fedora-all [bug 1131796]

Comment 23 Murray McAllister 2014-08-20 05:27:56 UTC
Created icecream tracking bugs for this issue:

Affects: fedora-all [bug 1131794]
Affects: epel-all [bug 1131795]

Comment 24 Murray McAllister 2014-08-20 05:28:00 UTC
Created distcc tracking bugs for this issue:

Affects: fedora-all [bug 1131791]
Affects: epel-6 [bug 1131792]

Comment 25 Murray McAllister 2014-08-20 05:28:04 UTC
Created grub2 tracking bugs for this issue:

Affects: fedora-all [bug 1131793]

Comment 26 Murray McAllister 2014-08-20 05:28:08 UTC
Created krfb tracking bugs for this issue:

Affects: fedora-all [bug 1131789]

Comment 27 Murray McAllister 2014-08-20 05:28:12 UTC
Created blender tracking bugs for this issue:

Affects: fedora-all [bug 1131790]

Comment 28 Murray McAllister 2014-08-20 05:30:13 UTC
According to https://bugs.mageia.org/show_bug.cgi?id=13943 a number of other packages may embed lzo. I checked the build logs for the above bugs and believe they do embed it.

Comment 29 David Walser 2014-08-20 21:02:48 UTC
Hi Murray,

I believe you missed the dump package.  I checked the dump-debuginfo package in Fedora Rawhide and found these files, which suggests that the bundled minilzo is indeed built:
/usr/src/debug/dump-0.4b44/compat/lib/minilzo.c
/usr/src/debug/dump-0.4b44/compat/include/minilzo.h
/usr/src/debug/dump-0.4b44/compat/include/lzoconf.h

Comment 30 Murray McAllister 2014-08-21 04:05:49 UTC
Created dump tracking bugs for this issue:

Affects: fedora-all [bug 1132282]

Comment 31 Murray McAllister 2014-08-21 04:06:32 UTC
(In reply to David Walser from comment #29)
> Hi Murray,
> 
> I believe you missed the dump package.  I checked the dump-debuginfo package
> in Fedora Rawhide and found these files, which suggests that the bundled
> minilzo is indeed built:
> /usr/src/debug/dump-0.4b44/compat/lib/minilzo.c
> /usr/src/debug/dump-0.4b44/compat/include/minilzo.h
> /usr/src/debug/dump-0.4b44/compat/include/lzoconf.h

I did miss it, thank you!

Comment 32 Fedora Update System 2014-08-30 03:52:50 UTC
distcc-3.2rc1-4.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 33 Fedora Update System 2014-08-30 03:55:27 UTC
distcc-3.2rc1-8.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 34 Fedora Update System 2014-09-06 20:31:57 UTC
distcc-3.2rc1-2.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 35 Fedora Update System 2014-09-23 04:26:34 UTC
icecream-1.0.1-8.20140822git.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 36 Fedora Update System 2014-11-19 15:57:31 UTC
icecream-1.0.1-8.20140822git.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 37 Fedora Update System 2014-11-19 15:58:47 UTC
icecream-1.0.1-8.20140822git.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 38 Fedora Update System 2014-12-12 04:23:52 UTC
grub2-2.02-0.13.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 39 Fedora Update System 2014-12-12 04:31:27 UTC
grub2-2.00-27.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 40 Fedora Update System 2014-12-17 04:44:50 UTC
grub2-2.00-27.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 41 Fedora Update System 2015-02-25 13:29:52 UTC
dump-0.4-0.24.b44.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.