Bug 1575536 (CVE-2018-1000301) - CVE-2018-1000301 curl: Out-of-bounds heap read when missing RTSP headers allows information leak or denial of service
Summary: CVE-2018-1000301 curl: Out-of-bounds heap read when missing RTSP headers allo...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-1000301
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1576996 1577001 1578682 1578683 1802796 1802797
Blocks: 1575537
TreeView+ depends on / blocked
 
Reported: 2018-05-07 08:37 UTC by Adam Mariš
Modified: 2021-09-09 13:58 UTC (History)
23 users (show)

Fixed In Version: curl 7.60.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-10 10:21:26 UTC
Embargoed:


Attachments (Terms of Use)
Upstream patch (1.46 KB, patch)
2018-05-07 08:45 UTC, Adam Mariš
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:3157 0 None None None 2018-10-30 07:43:56 UTC
Red Hat Product Errata RHSA-2018:3558 0 None None None 2018-11-13 08:36:39 UTC
Red Hat Product Errata RHSA-2020:0544 0 None None None 2020-02-18 14:44:05 UTC
Red Hat Product Errata RHSA-2020:0594 0 None None None 2020-02-25 12:11:34 UTC

Description Adam Mariš 2018-05-07 08:37:41 UTC
curl can be tricked into reading data beyond the end of a heap based buffer
used to store downloaded content.

When servers send RTSP responses back to curl, the data starts out with a set
of headers. curl parses that data to separate it into a number of headers to
deal with those appropriately and to find the end of the headers that signal
the start of the "body" part.

The function that splits up the response into headers is called
`Curl_http_readwrite_headers()` and in situations where it can't find a single
header in the buffer, it might end up leaving a pointer pointing into the
buffer instead of to the start of the buffer which then later on may lead to
an out of buffer read when code assumes that pointer points to a full buffer
size worth of memory to use.

This could potentially lead to information leakage but most likely a
crash/denial of service for applications if a server triggers this flaw.

Introduced by following patches:

https://github.com/curl/curl/commit/b2ef79ef3d47b37
https://github.com/curl/curl/commit/bc4582b68a673d3

Affected versions: curl 7.20.0 to and including curl 7.59.0
Not affected versions: curl < 7.20.0 and curl >= 7.60.0

Comment 2 Adam Mariš 2018-05-07 08:45:18 UTC
Created attachment 1432530 [details]
Upstream patch

Comment 3 Adam Mariš 2018-05-07 08:53:00 UTC
Acknowledgments:

Name: the Curl project
Upstream: the OSS-Fuzz project

Comment 6 Adam Mariš 2018-05-16 07:25:58 UTC
External References:

https://curl.haxx.se/docs/adv_2018-b138.html

Comment 7 Adam Mariš 2018-05-16 07:27:35 UTC
Created curl tracking bugs for this issue:

Affects: fedora-all [bug 1578683]

Comment 9 errata-xmlrpc 2018-10-30 07:43:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:3157 https://access.redhat.com/errata/RHSA-2018:3157

Comment 10 errata-xmlrpc 2018-11-13 08:36:28 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2018:3558 https://access.redhat.com/errata/RHSA-2018:3558

Comment 12 errata-xmlrpc 2020-02-18 14:44:03 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.5 Extended Update Support

Via RHSA-2020:0544 https://access.redhat.com/errata/RHSA-2020:0544

Comment 13 errata-xmlrpc 2020-02-25 12:11:32 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Advanced Update Support
  Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.4 Telco Extended Update Support

Via RHSA-2020:0594 https://access.redhat.com/errata/RHSA-2020:0594


Note You need to log in before you can comment on or make changes to this bug.