Bug 1799734 (CVE-2019-20388) - CVE-2019-20388 libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c
Summary: CVE-2019-20388 libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c
Alias: CVE-2019-20388
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1810057 1810058 1810059 1799736 1799738 1799739
Blocks: 1799791
TreeView+ depends on / blocked
Reported: 2020-02-06 18:50 UTC by Guilherme de Almeida Suckevicz
Modified: 2020-06-22 17:20 UTC (History)
17 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service. System availability is the highest threat from this vulnerability.
Clone Of:
Last Closed: 2020-06-22 17:20:34 UTC

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:2644 None None None 2020-06-22 12:26:47 UTC
Red Hat Product Errata RHSA-2020:2646 None None None 2020-06-22 13:08:49 UTC

Description Guilherme de Almeida Suckevicz 2020-02-06 18:50:25 UTC
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.

Reference and upstream commit:

Comment 1 Guilherme de Almeida Suckevicz 2020-02-06 18:50:57 UTC
Created libxml2 tracking bugs for this issue:

Affects: fedora-all [bug 1799736]

Created mingw-libxml2 tracking bugs for this issue:

Affects: epel-7 [bug 1799739]
Affects: fedora-all [bug 1799738]

Comment 4 Riccardo Schirone 2020-03-04 13:34:07 UTC
Function xmlSchemaValidateStream() in xmlschemas.c calls xmlSchemaSAXPlug(), which calls xmlSchemaPreRun().
xmlSchemaPreRun() sets `vctxt->xsiAssemble = 0;`, then if vctxt->schema is NULL it sets `vctxt->xsiAssemble = 1;` and it allocates a new schema, storing the pointer in vctxt->schema. 

Function xmlSchemaPostRun() is supposed to free the schema, but it does so only if vctxt->xsiAssemble's value is not 0. This is not the case sometimes, because function xmlSchemaValidateStream(), after having called xmlSchemaSAXPlug(), also calls xmlSchemaVStart() which calls again xmlSchemaPreRun(). As said, this last function initially sets `vctxt->xsiAssemble = 0;`, thus preventing the code to free the previously allocated schema.

Comment 7 errata-xmlrpc 2020-06-22 12:26:43 UTC
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 6
  JBoss Core Services on RHEL 7

Via RHSA-2020:2644 https://access.redhat.com/errata/RHSA-2020:2644

Comment 8 errata-xmlrpc 2020-06-22 13:08:47 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2020:2646 https://access.redhat.com/errata/RHSA-2020:2646

Comment 9 Product Security DevOps Team 2020-06-22 17:20:34 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Note You need to log in before you can comment on or make changes to this bug.