Bug 1555064 (CVE-2018-1000127) - CVE-2018-1000127 memcached: Integer Overflow in items.c:item_free()
Summary: CVE-2018-1000127 memcached: Integer Overflow in items.c:item_free()
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-1000127
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1555065 1557093 1557286 1557287 1557646 1557647 1557648 1557649
Blocks: 1555067
TreeView+ depends on / blocked
 
Reported: 2018-03-13 22:05 UTC by Laura Pardo
Modified: 2020-12-17 08:03 UTC (History)
28 users (show)

Fixed In Version: memcached 1.4.37
Clone Of:
Environment:
Last Closed: 2019-06-10 10:17:42 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2290 0 None None None 2018-07-30 17:41:54 UTC

Description Laura Pardo 2018-03-13 22:05:27 UTC 
A flaw was found in memcached version prior to 1.4.37. It contains an Integer
Overflow vulnerability in items.c:item_free() that can result in resource leaks
or data corruption, deadlocks and crashes due to items existing in hash table
being reused from free list. This attack appear to be exploitable via network
connectivity to the memcached service.


References:
https://github.com/memcached/memcached/issues/271
https://github.com/memcached/memcached/wiki/ReleaseNotes1437

Upstream Patch:
https://github.com/memcached/memcached/commit/a8c4a82787b8b6c256d61bd5c42fb7f92d1bae00
Comment 1 Laura Pardo 2018-03-13 22:06:26 UTC 
Created memcached tracking bugs for this issue:

Affects: openstack-rdo [bug 1555065]
Comment 4 Riccardo Schirone 2018-03-16 11:40:38 UTC 
RHEL 6 is affected by this flaw, being subject to the integer overflow in items.c:item_free(), but items are not put back in the freelist if they are still used. However, it can cause memory leaks and, potentially, resource exhaustion.
Comment 7 errata-xmlrpc 2018-07-30 17:41:41 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 10.0 (Newton)

Via RHSA-2018:2290 https://access.redhat.com/errata/RHSA-2018:2290
Note You need to log in before you can comment on or make changes to this bug.