Bug 1632932 (CVE-2018-1000810) - CVE-2018-1000810 rust: Buffer overflow in str::repeat function in the standard library
Summary: CVE-2018-1000810 rust: Buffer overflow in str::repeat function in the standar...
Status: CLOSED CURRENTRELEASE
Alias: CVE-2018-1000810
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20180924,repor...
Keywords: Security
Depends On: 1632933 1632934
Blocks: 1696271
TreeView+ depends on / blocked
 
Reported: 2018-09-25 20:27 UTC by Pedro Sampaio
Modified: 2019-07-15 09:12 UTC (History)
4 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2019-02-16 18:12:53 UTC


Attachments (Terms of Use)

Description Pedro Sampaio 2018-09-25 20:27:32 UTC
As reported in upstream advisory:

# Security adivsory for the Rust standard library - 2018-09-21 

The Rust team was recently notified of a security vulnerability affecting 
the `str::repeat` function in the standard library. If your code does not 
use this function, it is not affected. 

We are applying for a CVE for this vulnerability, but since there is no 
embargo, we have not filed for one yet. Once a CVE is assigned, we'll make a 
second post to make mention of the CVE number. 

## Overview 

This vulnerability is an instance of CWE-680: Integer Overflow to Buffer 
Overflow[1]. 

The `str::repeat` function in the standard library allows repeating a 
string a fixed number of times, returning an owned version of the final 
string. The capacity of the final string is calculated by multiplying 
the length of the string being repeated by the number of copies. This 
calculation can overflow, and this case was not properly checked for. 

The rest of the implementation of `str::repeat` contains unsafe code 
that relies on a preallocated vector having the capacity calculated 
earlier. On integer overflow the capacity will be less than required, 
and which then writes outside of the allocated buffer, leading to 
buffer overflow. 

## Affected Versions 

While the `str::repeat` function has been in Rust since 1.16.0, this 
vulnerability was introduced into the standard library in pull 
request #48657 [2]. The pull request was merged on March 6, 2018 and 
was first part of the 1.26.0 stable released on May 10, 2018. 

As such, this vulnerability affects: 

* Every nightly we've produced since March 6, 2018 
* Every beta produced since March 6, 2018 
* These specific Rust releases: 
  * 1.29.0 
  * 1.28.0 
  * 1.27.2 
  * 1.27.1 
  * 1.27.0 
  * 1.26.2 
  * 1.26.1 
  * 1.26.0 

## Mitigations 

This bug can be mitigated manually by auditing for calls to `str::repeat` 
and testing if the resulting vector's capacity will overflow. If it does, 
then the program should panic. 

For Rust 1.29, we'll be releasing a 1.29.1 on 2018-09-25 with the fix, 
which consists of checking for overflow and deterministically panicking 
if it happens. Nightlies and betas produced after 2019-09-21 will also 
contain a fix for this issue. 

We will not be releasing our own fixes for previous versions of Rust. 
The patch to fix 1.29 should roughly applicable to older versions, although 
the implementation has seen a few refactorings since it was introduced. 
The patch for 1.29 is included at the end of this email. If you 
need assistance patching an older version of Rust on your own, please reach 
out to our security mailing list, secu...@rust-lang.org, and we'll be happy 
to help. 

The current beta and nightly channels will be updated with a fix for this 
issue as well. 

References:

https://blog.rust-lang.org/2018/09/21/Security-advisory-for-std.html
https://groups.google.com/forum/#!topic/rustlang-security-announcements/CmSuTm-SaU0

Comment 1 Pedro Sampaio 2018-09-25 20:28:39 UTC
Created rust tracking bugs for this issue:

Affects: epel-7 [bug 1632934]
Affects: fedora-all [bug 1632933]

Comment 4 Riccardo Schirone 2019-07-15 08:45:23 UTC
Vulnerability introduced in commit https://github.com/rust-lang/rust/commit/08504fbb0b05abdd9543f08102b0d6275dde210c


Note You need to log in before you can comment on or make changes to this bug.