libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archive_read_support_format_iso9660.c, read_CE()/parse_rockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file. References: https://github.com/libarchive/libarchive/pull/1120/commits/8312eaa576014cd9b965012af51bc1f967b12423 https://github.com/libarchive/libarchive/pull/1120
Created libarchive tracking bugs for this issue: Affects: fedora-all [bug 1672900]
Created libarchive tracking bugs for this issue: Affects: epel-6 [bug 1672901]
Easily reproduced on Red Hat Enterprise 7 and 8. Did not reproduce on 6 due to a lack of bsdtar, but it looks vulnerable after a brief glance at the source code. Target function (read_ce) seems to use lots of pointer aliasing and I'm unclear what the actual while loop exit condition even means due lack of any comments, but guessing it has to do with the p pointer not getting incremented by read_rockridge.
Created libarchive3 tracking bugs for this issue: Affects: epel-6 [bug 1673424]
Created mingw-libarchive tracking bugs for this issue: Affects: fedora-all [bug 1674057]
Statement: This vulnerability is present in the libarchive package included in Red Hat Virtualization Hypervisor, however it is never exposed to ISO images created by attackers or users, so the vulnerability can not be exploited.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2298 https://access.redhat.com/errata/RHSA-2019:2298
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-1000020
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:3698 https://access.redhat.com/errata/RHSA-2019:3698