Bug 1367044 – CVE-2015-1379: Possible DoS with fork

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1367044 - CVE-2015-1379: Possible DoS with fork

Summary:	CVE-2015-1379: Possible DoS with fork

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	socat (Show other bugs)
Sub Component:
Version:	7.4
Hardware:	Unspecified Unspecified

Priority	unspecified Severity high
Target Milestone:	rc
Target Release:	---
Assigned To:	Paul Wouters
QA Contact:	Jan Blazek
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:	CVE-2015-1379
	Show dependency tree / graph

Reported:	2016-08-15 07:31 EDT by Gerd v. Egidy
Modified:	2017-08-01 14:57 EDT (History)
CC List:	1 user (show)

See Also:
Fixed In Version:	1.7.3.2-1
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-08-01 14:57:03 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2017:2049	normal	SHIPPED_LIVE	socat bug fix update	2017-08-01 14:13:19 EDT

Groups: None (edit)

Description Gerd v. Egidy 2016-08-15 07:31:37 EDT

Description of problem:
From Socat security advisory 6, CVE-2015-1379:

socats signal handler implementations are not async-signal-safe and can cause crash or freeze of socat processes

Details
  Socats signal handler implementations are not asnyc-signal-safe. When a signal
  is triggered while the process is within a non async-signal-safe function the
  signal handler will call a non async-signal-safe function too. POSIX specifies
  the behaviour in this situation as undefined. Dependend on involved functions,
  libraries, and operating system, the process can continue, freeze, or crash.
  Mostly this issue occurs when socat is in listening mode with fork option and
  a couple of child processes terminate at the same time.

http://www.dest-unreach.org/socat/contrib/socat-secadv6.txt

Please release an update with a fix for this issue.

Version-Release number of selected component (if applicable):
socat-1.7.2.2-5.el7

Comment 6 errata-xmlrpc 2017-08-01 14:57:03 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2049

Note You need to log in before you can comment on or make changes to this bug.