Bug 1339929 – CVE-2016-5028 libdwarf: Null pointer dereference in print_frame_inst_bytes()

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1339929 - (CVE-2016-5028) CVE-2016-5028 libdwarf: Null pointer dereference in print_frame_inst_bytes()

Summary:	CVE-2016-5028 libdwarf: Null pointer dereference in print_frame_inst_bytes()

Status:	NEW

Aliases:	CVE-2016-5028

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20160523,reported=2...
Keywords:	Security

Depends On:	1340129 1340128
Blocks:
	Show dependency tree / graph

Reported:	2016-05-26 04:29 EDT by Andrej Nemec
Modified:	2016-05-26 09:41 EDT (History)
CC List:	2 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Andrej Nemec 2016-05-26 04:29:49 EDT

A null pointer dereference vulnerability was found in libdwarf. It exists due to a corrupted object file. Libdwarf was not dealing with empty (bss-like) sections since it really did not expect to see such in sections it reads. Now libdwarf catches the object error so dwarfdump sees the section as empty.

References (with a link to PoC):

http://seclists.org/oss-sec/2016/q2/393

External references:

https://www.prevanders.net/dwarfbug.html

Upstream fix:

https://sourceforge.net/p/libdwarf/code/ci/a55b958926cc67f89a512ed30bb5a22b0adb10f4

Comment 1 Tom Hughes 2016-05-26 04:34:35 EDT

If you want to report an issue with the Fedora package then please do so against the proper component.

In the meantime please stop adding me to your RedHat internal security bugs.

Comment 2 Andrej Nemec 2016-05-26 09:41:55 EDT

Created libdwarf tracking bugs for this issue:

Affects: fedora-all [bug 1340128]
Affects: epel-6 [bug 1340129]

Note You need to log in before you can comment on or make changes to this bug.