Bug 1684374 (CVE-2019-9192) - CVE-2019-9192 glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
Summary: CVE-2019-9192 glibc: uncontrolled recursion in function check_dst_limits_calc...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2019-9192
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1684375
Blocks: 1684377
TreeView+ depends on / blocked
 
Reported: 2019-03-01 06:20 UTC by Dhananjay Arunesh
Modified: 2023-12-15 16:22 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Upstream glibc does not classify this bug as a security issue as per: https://sourceware.org/glibc/wiki/Security%20Exceptions
Clone Of:
Environment:
Last Closed: 2019-04-01 08:09:26 UTC
Embargoed:

Attachments (Terms of Use)

Description Dhananjay Arunesh 2019-03-01 06:20:04 UTC 
In the GNU C Library (aka glibc) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\1\\1)*' in grep, a different issue than CVE-2018-20796.
NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.

Reference:
https://sourceware.org/bugzilla/show_bug.cgi?id=24269
Comment 1 Dhananjay Arunesh 2019-03-01 06:20:16 UTC 
Created glibc tracking bugs for this issue:

Affects: fedora-all [bug 1684375]
Comment 2 Huzaifa S. Sidhpurwala 2019-04-01 08:09:26 UTC 
Upstream does not classify this as a security flaw as per:
https://sourceware.org/glibc/wiki/Security%20Exceptions

"Consequently, resource exhaustion issues which can be triggered only with crafted patterns (either during compilation or execution) are not treated as security bugs. (This does not mean we do not intend to fix such issues as regular bugs if possible.) "
Note You need to log in before you can comment on or make changes to this bug.