Bug 1799734 (CVE-2019-20388) - CVE-2019-20388 libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c
Summary: CVE-2019-20388 libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-20388
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1799736 1799738 1799739 1810057 1810058 1810059 1921208 1921209 1921210
Blocks: 1799791 1997390
TreeView+ depends on / blocked
 
Reported: 2020-02-06 18:50 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-11-18 03:24 UTC (History)
24 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service. System availability is the highest threat from this vulnerability.
Clone Of:
Environment:
Last Closed: 2020-06-22 17:20:34 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:2644 0 None None None 2020-06-22 12:26:47 UTC
Red Hat Product Errata RHSA-2020:2646 0 None None None 2020-06-22 13:08:49 UTC
Red Hat Product Errata RHSA-2020:3996 0 None None None 2020-09-29 20:27:04 UTC
Red Hat Product Errata RHSA-2020:4479 0 None None None 2020-11-04 01:20:48 UTC

Description Guilherme de Almeida Suckevicz 2020-02-06 18:50:25 UTC 
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.

Reference and upstream commit:
https://gitlab.gnome.org/GNOME/libxml2/merge_requests/68
Comment 1 Guilherme de Almeida Suckevicz 2020-02-06 18:50:57 UTC 
Created libxml2 tracking bugs for this issue:

Affects: fedora-all [bug 1799736]


Created mingw-libxml2 tracking bugs for this issue:

Affects: epel-7 [bug 1799739]
Affects: fedora-all [bug 1799738]
Comment 4 Riccardo Schirone 2020-03-04 13:34:07 UTC 
Function xmlSchemaValidateStream() in xmlschemas.c calls xmlSchemaSAXPlug(), which calls xmlSchemaPreRun().
xmlSchemaPreRun() sets `vctxt->xsiAssemble = 0;`, then if vctxt->schema is NULL it sets `vctxt->xsiAssemble = 1;` and it allocates a new schema, storing the pointer in vctxt->schema. 

Function xmlSchemaPostRun() is supposed to free the schema, but it does so only if vctxt->xsiAssemble's value is not 0. This is not the case sometimes, because function xmlSchemaValidateStream(), after having called xmlSchemaSAXPlug(), also calls xmlSchemaVStart() which calls again xmlSchemaPreRun(). As said, this last function initially sets `vctxt->xsiAssemble = 0;`, thus preventing the code to free the previously allocated schema.
Comment 7 errata-xmlrpc 2020-06-22 12:26:43 UTC 
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 6
  JBoss Core Services on RHEL 7

Via RHSA-2020:2644 https://access.redhat.com/errata/RHSA-2020:2644
Comment 8 errata-xmlrpc 2020-06-22 13:08:47 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2020:2646 https://access.redhat.com/errata/RHSA-2020:2646
Comment 9 Product Security DevOps Team 2020-06-22 17:20:34 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-20388
Comment 10 errata-xmlrpc 2020-09-29 20:27:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3996 https://access.redhat.com/errata/RHSA-2020:3996
Comment 11 errata-xmlrpc 2020-11-04 01:21:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4479 https://access.redhat.com/errata/RHSA-2020:4479
Note You need to log in before you can comment on or make changes to this bug.