Bug 1115767 (CVE-2014-4715) - CVE-2014-4715 lz4: LZ4_decompress_generic() integer overflow (32-bit arches)
Summary: CVE-2014-4715 lz4: LZ4_decompress_generic() integer overflow (32-bit arches)
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2014-4715
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1116362
Blocks: 1112414
TreeView+ depends on / blocked
 
Reported: 2014-07-03 05:07 UTC by Huzaifa S. Sidhpurwala
Modified: 2019-09-29 13:19 UTC (History)
33 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-07-07 07:19:05 UTC


Attachments (Terms of Use)

Description Huzaifa S. Sidhpurwala 2014-07-03 05:07:46 UTC
Don A. Bailey of Lab Mouse Security reported an integer overflow issue in various implementations of LZO (Lempel–Ziv–Oberhumer) and LZ4 compression algorithms.  The issue is in the handling of "literal runs" during decompression, and can lead to application crash and, possibly, code execution.

The CVE-2014-4715 assignment, from the perspective of the LZ4 product, is for issue 134 fixed in r119:

https://code.google.com/p/lz4/issues/detail?id=134
https://code.google.com/p/lz4/source/detail?r=119

Comment 1 Prasad J Pandit 2014-07-04 10:02:38 UTC
Upstream kernel fix:
--------------------
  -> https://git.kernel.org/linus/4a3a99045177369700c60d074c0e525e8093b0fc

Comment 2 Prasad J Pandit 2014-07-04 10:03:27 UTC
Statement:

This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.

Comment 4 Prasad J Pandit 2014-07-04 10:09:46 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1116362]

Comment 5 Josh Boyer 2014-07-04 14:45:49 UTC
(In reply to Prasad J Pandit from comment #1)
> Upstream kernel fix:
> --------------------
>   -> https://git.kernel.org/linus/4a3a99045177369700c60d074c0e525e8093b0fc

There's some disagreement and an alternate fix proposed on this:

http://comments.gmane.org/gmane.linux.kernel/1738748


Note You need to log in before you can comment on or make changes to this bug.