Bug 1478373 (CVE-2017-7555) - CVE-2017-7555 augeas: Improper handling of escaped strings leading to memory corruption
Summary: CVE-2017-7555 augeas: Improper handling of escaped strings leading to memory ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-7555
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1475621 1481545 1481546 1482340 1483825 1483826 1483913 1724856
Blocks: 1478377
TreeView+ depends on / blocked
 
Reported: 2017-08-04 13:07 UTC by Adam Mariš
Modified: 2021-02-17 01:46 UTC (History)
36 users (show)

Fixed In Version: augeas 1.8.1
Clone Of:
Environment:
Last Closed: 2017-09-26 00:21:12 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github hercules-team augeas pull 480 0 None None None 2017-08-31 13:01:56 UTC
Red Hat Product Errata RHSA-2017:2788 0 normal SHIPPED_LIVE Important: augeas security update 2017-09-21 15:36:59 UTC
Red Hat Product Errata RHSA-2019:2403 0 None None None 2019-08-07 11:36:21 UTC

Description Adam Mariš 2017-08-04 13:07:59 UTC 
It was found that augeas does incorrect escaping in aug_escape_name() function causing denial-of-service.

Product bug:

https://bugzilla.redhat.com/show_bug.cgi?id=1475621
Comment 1 Adam Mariš 2017-08-04 13:08:09 UTC 
Acknowledgments:

Name: Han Han (Red Hat)
Comment 2 Doran Moppert 2017-08-10 07:33:34 UTC 
Upstream patch:

https://github.com/hercules-team/augeas/pull/480
Comment 7 Doran Moppert 2017-08-17 04:50:40 UTC 
Since the patch is already public, going for immediate disclosure on this.  Rated as Important due to exposure in libvirtd.

The above patch includes good test coverage, so no further test/repro is required for QE.
Comment 8 Doran Moppert 2017-08-17 04:51:18 UTC 
Created augeas tracking bugs for this issue:

Affects: fedora-all [bug 1482340]
Comment 9 Doran Moppert 2017-08-18 02:30:50 UTC 
Upstream release 1.8.1 contains the fix for this issue:

https://github.com/hercules-team/augeas/releases/tag/release-1.8.1

Tarball available from:

http://download.augeas.net/
Comment 13 errata-xmlrpc 2017-09-21 11:37:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2788 https://access.redhat.com/errata/RHSA-2017:2788
Comment 15 errata-xmlrpc 2019-08-07 11:36:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Advanced Update Support
  Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.3 Telco Extended Update Support

Via RHSA-2019:2403 https://access.redhat.com/errata/RHSA-2019:2403
Note You need to log in before you can comment on or make changes to this bug.