Bug 1784740 (CVE-2019-19725) - CVE-2019-19725 sysstat: double free in check_file_actlst() in sa_common.c may lead to arbitrary code execution
Summary: CVE-2019-19725 sysstat: double free in check_file_actlst() in sa_common.c may...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2019-19725
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1785293
Blocks: 1784742
TreeView+ depends on / blocked
 
Reported: 2019-12-18 08:50 UTC by Marian Rehak
Modified: 2023-03-24 16:30 UTC (History)
4 users (show)

Fixed In Version: sysstat 12.2.1
Doc Type: If docs needed, set a value
Doc Text:
A double-free vulnerability was found in sysstat in the way the `sadf` command processes the contents of data files created by the `sar` command. Saved binary data files with support for `extra_desc` structures may be vulnerable to this flaw. A remote attacker could exploit this flaw by creating a specially crafted file with malformed data that, when loaded by a victim, would cause the application to potentially execute arbitrary code.
Clone Of:
Environment:
Last Closed: 2019-12-27 20:09:26 UTC
Embargoed:

Attachments (Terms of Use)

Description Marian Rehak 2019-12-18 08:50:56 UTC 
Sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.

Upstream Issue:

https://github.com/sysstat/sysstat/issues/242
Comment 1 Dave Baker 2019-12-19 15:54:29 UTC 
Created sysstat tracking bugs for this issue:

Affects: fedora-all [bug 1785293]
Comment 2 Mauro Matteo Cascella 2019-12-27 11:36:55 UTC 
Upstream fix:
https://github.com/sysstat/sysstat/commit/a5c8abd4a481ee6e27a3acf00e6d9b0f023e20ed
Comment 3 Mauro Matteo Cascella 2019-12-27 15:55:54 UTC 
The flaw has been introduced upstream in version 12.1.7 with an update to sar/sadf to handle a possible new file format in saved binary data files: 

https://github.com/sysstat/sysstat/commit/44c826602a3d7d899c728bd9e6c3488397c5009f

More specifically, new code has been included in function check_file_actlst() to check if extra structures (`extra_desc`) are present in saved files. In case of malformed data, a previously freed buffer is freed again, leading to a double free vulnerability.

The patch assigns a NULL value to the buffer pointer after the first free(). This implicitly avoids the second free(), which only occurs if the buffer is not NULL.
Comment 4 Mauro Matteo Cascella 2019-12-27 17:42:57 UTC 
Statement:

This flaw does not affect the versions of sysstat as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8 as they do not include support for `extra_desc` structures in binary data files created by the `sar` command. Consequently, they do not include the vulnerable code leading to the double free vulnerability either.
Comment 5 Product Security DevOps Team 2019-12-27 20:09:26 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19725
Note You need to log in before you can comment on or make changes to this bug.