Bug 1344251 - (CVE-2016-4472) CVE-2016-4472 expat: Undefined behavior and pointer overflows
CVE-2016-4472 expat: Undefined behavior and pointer overflows
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20160515,repor...
: Security
Depends On: 1344255 1344256 1344252 1344253 1344254 1387550 1387551 1387552 1387553 1387554 1387555 1387556 1387557
Blocks: 1296104 1344258
  Show dependency treegraph
 
Reported: 2016-06-09 05:31 EDT by Adam Mariš
Modified: 2017-03-23 03:10 EDT (History)
17 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Adam Mariš 2016-06-09 05:31:33 EDT
It was found that original patch for issues CVE-2015-1283 and CVE-2015-2716 used overflow checks that could be optimized out by some compilers applying certain optimization settings, which can cause the vulnerability to remain even after applying the patch.

One pattern in the fix for CVE-2015-1283/CVE-2015-2716 is:

/* bufferSize is positive here */
do {
bufferSize *= 2;
} while (bufferSize < neededSize && bufferSize > 0);
if (bufferSize <= 0) {
errorCode = XML_ERROR_NO_MEMORY;
return NULL;

Any of the modern optimizing compiler, IF able to infer that bufferSize is initially positive (which is true but not obvious to see through local reasoning), will eliminate bufferSize > 0 as always true when the execution is defined, and bufferSize <= 0 as always false when the execution is defined.


Without knowing that bufferSize starts positive, an optimizing compiler could also move the test bufferSize > 0 out of the loop, that is, compile the code as if it had been written:

if (bufferSize <= 0)
errorCode = XML_ERROR_NO_MEMORY;
return NULL;
else {
do {
bufferSize *= 2;
} while (bufferSize < neededSize);
}

Both cases leads to not eliminating the vulnerability.

Upstream patch:

https://sourceforge.net/p/expat/code_git/ci/f0bec73b018caa07d3e75ec8dd967f3785d71bde/tree/expat/lib/xmlparse.c?diff=a238d7ea7a715ef3850c4cbdd86aeda7077b6bbc
Comment 1 Adam Mariš 2016-06-09 05:31:52 EDT
Acknowledgments:

Name: the Expat project
Upstream: Pascal Cuoq (TrustInSoft)
Comment 2 Adam Mariš 2016-06-09 05:33:15 EDT
Created compat-expat1 tracking bugs for this issue:

Affects: fedora-all [bug 1344253]
Comment 3 Adam Mariš 2016-06-09 05:33:28 EDT
Created expat tracking bugs for this issue:

Affects: fedora-all [bug 1344252]
Comment 4 Adam Mariš 2016-06-09 05:33:39 EDT
Created mingw-expat tracking bugs for this issue:

Affects: fedora-all [bug 1344254]
Affects: epel-7 [bug 1344256]
Comment 5 Adam Mariš 2016-06-09 05:33:49 EDT
Created expat21 tracking bugs for this issue:

Affects: epel-all [bug 1344255]

Note You need to log in before you can comment on or make changes to this bug.