Bug 1383569 – CVE-2014-9911 icu: stack-based buffer overflow in uloc_getDisplayName

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1383569 - (CVE-2014-9911) CVE-2014-9911 icu: stack-based buffer overflow in uloc_getDisplayName

Summary:	CVE-2014-9911 icu: stack-based buffer overflow in uloc_getDisplayName

Status:	CLOSED WONTFIX

Aliases:	CVE-2014-9911

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20161122,repor...
Keywords:	Security

Depends On:	1397625 1397626
Blocks:	1360344
	Show dependency tree / graph

Reported:	2016-10-11 01:48 EDT by Doran Moppert
Modified:	2016-11-29 22:51 EST (History)
CC List:	11 users (show)

See Also:
Fixed In Version:	icu 54.1
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2016-11-29 22:51:01 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Doran Moppert 2016-10-11 01:48:29 EDT

A locale string of more than 255 characters passed to uloc_getDisplayName() could overflow a buffer on the stack, leading a crash or, potentially, code execution.

Upstream patch:

http://bugs.icu-project.org/trac/changeset/35699

Upstream issue (private as at 2016-10-11):

http://bugs.icu-project.org/trac/ticket/10891

Comment 1 Doran Moppert 2016-10-11 01:52:45 EDT

PHP bug (already fixed in bug 1065838):

https://bugs.php.net/bug.php?id=67397

Related ICU bug:

http://bugs.icu-project.org/trac/ticket/11936

Comment 4 Doran Moppert 2016-11-22 20:36:02 EST

Created mingw-icu tracking bugs for this issue:

Affects: fedora-all [bug 1397625]
Affects: epel-7 [bug 1397626]

Comment 5 Doran Moppert 2016-11-23 01:15:53 EST

The affected function has only one buffer on the stack, and it is overflowed at the end by copying a null-terminated string with strcpy().

Thus, building with -fstack-protector-strong (as in Red Hat Enterprise Linux and Fedora) provides a reasonable level of defence against this attack achieving anything more than a crash.  An attacker would need to discover the stack canary through an information leak elsewhere, and then cause multiple strcpy()s to overwrite the return address as well as the canary.  This may not be impossible, but it's certainly extremely difficult.

Comment 6 Doran Moppert 2016-11-24 20:04:54 EST

CVE assignment:

http://seclists.org/oss-sec/2016/q4/525

Comment 7 Doran Moppert 2016-11-29 00:03:57 EST

This flaw has manifested in PHP and been worked around there twice, as CVE-2014-9912 and CVE-2016-6294.  Fixing this flaw in icu will also mitigate both of those PHP flaws.

Note You need to log in before you can comment on or make changes to this bug.