Bug 1561953 (CVE-2018-8778) - CVE-2018-8778 ruby: Buffer under-read in String#unpack
Summary: CVE-2018-8778 ruby: Buffer under-read in String#unpack
Status: CLOSED ERRATA
Alias: CVE-2018-8778
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20180328,repor...
Keywords: Security
Depends On: 1566580 1561956 1561957 1561958 1563869 1563870 1563871 1563872 1563873 1563874 1565258 1566581 1566582 1566583 1566584 1651798 1652037 1652038
Blocks: 1561954
TreeView+ depends on / blocked
 
Reported: 2018-03-29 09:09 UTC by Adam Mariš
Modified: 2019-06-11 11:13 UTC (History)
30 users (show)

(edit)
A integer underflow was found in the way String#unpack decodes the unpacking format. An attacker, able to control the unpack format, could use this flaw to disclose arbitrary parts of the application's memory.
Clone Of:
(edit)
Last Closed: 2019-06-10 10:19:18 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:3729 None None None 2018-11-29 09:57 UTC
Red Hat Product Errata RHSA-2018:3730 None None None 2018-11-29 10:11 UTC
Red Hat Product Errata RHSA-2018:3731 None None None 2018-11-29 10:23 UTC

Description Adam Mariš 2018-03-29 09:09:13 UTC
String#unpack receives format specifiers as its parameter, and can be specified the position of parsing the data by the specifier @. If a big number is passed with @, the number is treated as the negative value, and out-of-buffer read is occurred. So, if a script accepts an external input as the argument of String#unpack, the attacker can read data on heaps.

Affected versions:

Ruby 2.2 series: 2.2.9 and earlier
Ruby 2.3 series: 2.3.6 and earlier
Ruby 2.4 series: 2.4.3 and earlier
Ruby 2.5 series: 2.5.0 and earlier

External References:

https://www.ruby-lang.org/en/news/2018/03/28/buffer-under-read-unpack-cve-2018-8778/

Comment 1 Adam Mariš 2018-03-29 09:15:42 UTC
Created ruby tracking bugs for this issue:

Affects: fedora-all [bug 1561957]

Comment 11 Cedric Buissart 🐶 2018-04-12 08:13:00 UTC
Mitigation:

Vulnerable code when String#unpack's argument is attacker controlled.
In the unpack format string argemument, manual sanitization can be done by preventing the number following '@' to overflow to a negative number. See https://dev.to/sqreenio/an-in-depth-look-at-cve-2018-8878-or-why-integer-overflows-are-still-a-thing-1n01 for mitigation details.

Comment 13 Cedric Buissart 🐶 2018-04-13 08:31:41 UTC
Upstream fix : 
https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=62992

Comment 14 Andrej Nemec 2018-05-14 15:26:15 UTC
Statement:

This issue affects the versions of ruby as shipped with Red Hat CloudForms 4. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

This issue affects the versions of ruby as shipped with Red Hat Subscription Asset Manager 1. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Comment 20 errata-xmlrpc 2018-11-29 09:57:00 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2018:3729 https://access.redhat.com/errata/RHSA-2018:3729

Comment 21 errata-xmlrpc 2018-11-29 10:11:39 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2018:3730 https://access.redhat.com/errata/RHSA-2018:3730

Comment 22 errata-xmlrpc 2018-11-29 10:22:51 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2018:3731 https://access.redhat.com/errata/RHSA-2018:3731


Note You need to log in before you can comment on or make changes to this bug.