Bug 1765164 - libgit2: Out-of-bounds write via commits with large number of parents
Summary: libgit2: Out-of-bounds write via commits with large number of parents
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1765165 1765166 1770895
Blocks: 1765169
TreeView+ depends on / blocked
 
Reported: 2019-10-24 12:51 UTC by Pedro Sampaio
Modified: 2023-09-26 14:03 UTC (History)
5 users (show)

Fixed In Version: libgit2 0.28.3
Clone Of:
Environment:
Last Closed: 2021-10-25 22:12:34 UTC
Embargoed:


Attachments (Terms of Use)

Description Pedro Sampaio 2019-10-24 12:51:39 UTC
A flaw was found in libgit2 before version 0.28.3. As described in upstream change logs, a carefully constructed commit object with a very large number of parents may lead to potential out-of-bounds writes or potential denial of service.

Upstream patch:

https://github.com/libgit2/libgit2/commit/3316f666566f768eb8aa8de521a5262524dc3424

References:

https://github.com/libgit2/libgit2/releases/tag/v0.28.3

Comment 1 Pedro Sampaio 2019-10-24 12:51:55 UTC
Created libgit2 tracking bugs for this issue:

Affects: epel-6 [bug 1765166]
Affects: fedora-all [bug 1765165]

Comment 4 Marco Benatto 2019-11-11 13:40:33 UTC
There's a bug on libgit2 at alloc_parents() function. When using commit_quick_parse() function to parse commit information, it calculates the number of existing parent commits and pass this value to alloc_parents() as parameter. The allow_parents() function tries to allocate the required amount of memory by simply multiplying the number of parents requested by the size of the respective element's size, this result is cast to uint32_t type which makes the function prone to overflow. An attacker can leverage it by crafting a commit object with a big amount of parent commits in order to trigger the overflow in the memory amount, this will further implies in out-of-bounds write at commit_quick_parse() leading to Deny-of-Service issue or possible allowing arbitrary code execution under certain conditions.


Note You need to log in before you can comment on or make changes to this bug.