Bug 1344251 (CVE-2016-4472) - CVE-2016-4472 expat: Undefined behavior and pointer overflows
Summary: CVE-2016-4472 expat: Undefined behavior and pointer overflows
Status: CLOSED WONTFIX
Alias: CVE-2016-4472
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
(Show other bugs)
Version: unspecified
Hardware: All Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20160515,repor...
Keywords: Security
Depends On: 1344255 1344256 1344252 1344253 1344254 1387550 1387551 1387552 1387553 1387554 1387555 1387556 1387557
Blocks: 1296104 1344258
TreeView+ depends on / blocked
 
Reported: 2016-06-09 09:31 UTC by Adam Mariš
Modified: 2018-07-05 21:35 UTC (History)
47 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2018-07-05 21:35:45 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

Description Adam Mariš 2016-06-09 09:31:33 UTC
It was found that original patch for issues CVE-2015-1283 and CVE-2015-2716 used overflow checks that could be optimized out by some compilers applying certain optimization settings, which can cause the vulnerability to remain even after applying the patch.

One pattern in the fix for CVE-2015-1283/CVE-2015-2716 is:

/* bufferSize is positive here */
do {
bufferSize *= 2;
} while (bufferSize < neededSize && bufferSize > 0);
if (bufferSize <= 0) {
errorCode = XML_ERROR_NO_MEMORY;
return NULL;

Any of the modern optimizing compiler, IF able to infer that bufferSize is initially positive (which is true but not obvious to see through local reasoning), will eliminate bufferSize > 0 as always true when the execution is defined, and bufferSize <= 0 as always false when the execution is defined.


Without knowing that bufferSize starts positive, an optimizing compiler could also move the test bufferSize > 0 out of the loop, that is, compile the code as if it had been written:

if (bufferSize <= 0)
errorCode = XML_ERROR_NO_MEMORY;
return NULL;
else {
do {
bufferSize *= 2;
} while (bufferSize < neededSize);
}

Both cases leads to not eliminating the vulnerability.

Upstream patch:

https://sourceforge.net/p/expat/code_git/ci/f0bec73b018caa07d3e75ec8dd967f3785d71bde/tree/expat/lib/xmlparse.c?diff=a238d7ea7a715ef3850c4cbdd86aeda7077b6bbc

Comment 1 Adam Mariš 2016-06-09 09:31:52 UTC
Acknowledgments:

Name: the Expat project
Upstream: Pascal Cuoq (TrustInSoft)

Comment 2 Adam Mariš 2016-06-09 09:33:15 UTC
Created compat-expat1 tracking bugs for this issue:

Affects: fedora-all [bug 1344253]

Comment 3 Adam Mariš 2016-06-09 09:33:28 UTC
Created expat tracking bugs for this issue:

Affects: fedora-all [bug 1344252]

Comment 4 Adam Mariš 2016-06-09 09:33:39 UTC
Created mingw-expat tracking bugs for this issue:

Affects: fedora-all [bug 1344254]
Affects: epel-7 [bug 1344256]

Comment 5 Adam Mariš 2016-06-09 09:33:49 UTC
Created expat21 tracking bugs for this issue:

Affects: epel-all [bug 1344255]


Note You need to log in before you can comment on or make changes to this bug.