Bug 1565468 – CVE-2018-9838 ocaml: Integer overflow in byterun/bigarray.c:caml_ba_deserialize() allows remote attackers to cause a denial of service or other unspecified impact

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1565468 - (CVE-2018-9838) CVE-2018-9838 ocaml: Integer overflow in byterun/bigarray.c:caml_ba_deserialize() allows remote attackers to cause a denial of service or other unspecified impact

Summary:	CVE-2018-9838 ocaml: Integer overflow in byterun/bigarray.c:caml_ba_deseriali...

Status:	NEW

Aliases:	CVE-2018-9838

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20180406,reported=2...
Keywords:	Security

Depends On:	1565471 1566999 1565470
Blocks:	1565476
	Show dependency tree / graph

Reported:	2018-04-10 01:20 EDT by Sam Fowler
Modified:	2018-04-13 05:39 EDT (History)
CC List:	4 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Sam Fowler 2018-04-10 01:20:22 EDT

The OCaml standard library in version 4.06.00 has an integer overflow vulnerability in byterun/bigarray.c:caml_ba_deserialize() when handling serialized (marshalled) data. A remote attacker could exploit this to cause a denial of service or possible code execution by supplying a crafted serialized object.


Upstream Issue:

https://caml.inria.fr/mantis/view.php?id=7765

Comment 1 Sam Fowler 2018-04-10 01:22:24 EDT

Created ocaml tracking bugs for this issue:

Affects: fedora-all [bug 1565471]

Comment 5 Richard W.M. Jones 2018-04-10 03:04:23 EDT

I think the impact of this should be "low".

My reasoning is that the Marshal interface is unsafe and should not
be used when sending data to untrusted end points.  The documentation
is quite explicit about this.

It is possible to crash the remote end point in multiple ways, eg:

let m = Marshal.to_string (1, 2) []
let x : bool * string = Marshal.from_string m 0
let () = Printf.printf "%b * %s" (fst x) (snd x)

$ ocamlopt crash.ml -o crash
$ ./crash 
Segmentation fault (core dumped)

OCaml provides ways to serialize data safely but Marshal is a low-level
interface which doesn't do that.

Of course I will fix this problem anyway in Fedora & RHEL.

Comment 6 Richard W.M. Jones 2018-04-11 07:57:02 EDT

They're still working on a fix upstream, but the latest proposal is
https://github.com/ocaml/ocaml/pull/1718

Note You need to log in before you can comment on or make changes to this bug.