Bug 1620219 (CVE-2018-12115) - CVE-2018-12115 nodejs: Out of bounds (OOB) write via UCS-2 encoding
Summary: CVE-2018-12115 nodejs: Out of bounds (OOB) write via UCS-2 encoding
Status: CLOSED ERRATA
Alias: CVE-2018-12115
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,public=20180811,repo...
Keywords: Security
Depends On: 1621655 1621656 1623736 1621652 1621654 1621657 1621761 1621762 1621763 1621764 1621766 1623735 1638279
Blocks: 1620220
TreeView+ depends on / blocked
 
Reported: 2018-08-22 17:47 UTC by Pedro Sampaio
Modified: 2019-06-10 10:36 UTC (History)
41 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2019-06-10 10:36:15 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2552 None None None 2018-08-22 21:12 UTC
Red Hat Product Errata RHSA-2018:2553 None None None 2018-08-22 21:14 UTC
Red Hat Product Errata RHSA-2018:2944 None None None 2018-10-18 07:44 UTC
Red Hat Product Errata RHSA-2018:2949 None None None 2018-10-18 10:10 UTC
Red Hat Product Errata RHSA-2018:3537 None None None 2018-12-03 17:28 UTC

Description Pedro Sampaio 2018-08-22 17:47:27 UTC
Node.js TSC member Сковорода Никита Андреевич (Nikita Skovoroda / @ChALkeR) discovered an OOB write in Buffer that can be used to write to memory outside of a Buffer's memory space. This can corrupt unrelated Buffer objects or cause the Node.js process to crash.

When used with UCS-2 encoding (recognized by Node.js under the names 'ucs2', 'ucs-2', 'utf16le' and 'utf-16le'), Buffer#write() can be abused to write outside of the bounds of a single Buffer. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.

Impact:

All previous versions of Node.js 6.x (LTS "Boron") are vulnerable
All previous versions of Node.js 8.x (LTS "Carbon") are vulnerable
All previous versions of Node.js 10.x (Current) are vulnerable

References:

https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/

Comment 1 Scott Gayou 2018-08-22 20:50:15 UTC
Upstream Fix:

https://github.com/nodejs/node/commit/fc14d812b7

Comment 2 errata-xmlrpc 2018-08-22 21:12:44 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Application Runtimes Node.js 8

Via RHSA-2018:2552 https://access.redhat.com/errata/RHSA-2018:2552

Comment 3 errata-xmlrpc 2018-08-22 21:14:32 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Application Runtimes Node.js 10

Via RHSA-2018:2553 https://access.redhat.com/errata/RHSA-2018:2553

Comment 4 Scott Gayou 2018-08-23 17:13:14 UTC
All versions impacted. nodejs advisory doesn't mention 4.x, which also segfaults. Guessing because node 4 is end of lifed.

Comment 6 Scott Gayou 2018-08-23 17:28:06 UTC
Created nodejs tracking bugs for this issue:

Affects: epel-all [bug 1621655]
Affects: fedora-all [bug 1621656]

Comment 11 Jason Shepherd 2018-08-28 02:13:27 UTC
Statement:

Openshift Container Platform 3.x versions are potentially vulnerable via the nodejs-slave-jenkins and nodejs-node-jenkins components. However a build would have to occur with a malicious jenkins pipeline, or nodejs source code supplied by an attacker, reducing the impact of this flaw to moderate.

Comment 13 Jason Shepherd 2018-08-28 02:32:31 UTC
Mitigation:

On Openshift Container Platform 3.x you can override the container image used on the Jenkins Slave by specifying the JENKINS_SLAVE_IMAGE environment variable in your jenkins deployment configuration. Ref:

https://github.com/openshift/jenkins/blob/8e1ab16fb5f44d6570018c5dfa3407692fdba6e5/2/contrib/jenkins/kube-slave-common.sh#L27-L33

Comment 14 Jason Shepherd 2018-08-28 06:14:38 UTC
The logging-kibana component of Openshift Container Platform 3.x does't write to any Buffers, so is not affected by this vulnerability.

Comment 15 Jason Shepherd 2018-08-29 08:01:18 UTC
The logging-auth-proxy component of Openshift Container Platform 3.x uses NodeJS 0.10 which is not affected by this issue.

Comment 16 Jason Shepherd 2018-08-30 04:01:22 UTC
.

Comment 20 Tomas Hoger 2018-09-10 14:29:31 UTC
Fixed upstream in Node.js 6.14.4, 8.11.4, and 10.9.0:

https://nodejs.org/en/blog/release/v6.14.4/
https://nodejs.org/en/blog/release/v8.11.4/
https://nodejs.org/en/blog/release/v10.9.0/

Comment 23 errata-xmlrpc 2018-10-18 07:44:18 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2018:2944 https://access.redhat.com/errata/RHSA-2018:2944

Comment 24 errata-xmlrpc 2018-10-18 10:10:35 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2018:2949 https://access.redhat.com/errata/RHSA-2018:2949

Comment 25 errata-xmlrpc 2018-12-03 17:28:10 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.11

Via RHSA-2018:3537 https://access.redhat.com/errata/RHSA-2018:3537


Note You need to log in before you can comment on or make changes to this bug.