Bug 1835253 (CVE-2020-12762) - CVE-2020-12762 json-c: integer overflow and out-of-bounds write via a large JSON file
Summary: CVE-2020-12762 json-c: integer overflow and out-of-bounds write via a large J...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-12762
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1835255 1835624 1835625 1835626 1836219 1836220
Blocks: 1835256
TreeView+ depends on / blocked
 
Reported: 2020-05-13 13:50 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-04-27 05:49 UTC (History)
5 users (show)

Fixed In Version: json-c-0.14-3.fc33
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in json-c. In printbuf_memappend, certain crafted values can overflow the memory allowing an attacker to write past the memory boundary. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Clone Of:
Environment:
Last Closed: 2021-11-09 17:51:58 UTC

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:4382 0 None None None 2021-11-09 18:32:33 UTC

Description Guilherme de Almeida Suckevicz 2020-05-13 13:50:32 UTC 
json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.

Reference:
https://github.com/json-c/json-c/pull/592
Comment 1 Guilherme de Almeida Suckevicz 2020-05-13 13:50:49 UTC 
Created json-c tracking bugs for this issue:

Affects: fedora-all [bug 1835255]
Comment 2 Huzaifa S. Sidhpurwala 2020-05-14 08:13:11 UTC 
Upstream patch: https://github.com/json-c/json-c/pull/592/commits/d07b91014986900a3a75f306d302e13e005e9d67
Comment 4 Huzaifa S. Sidhpurwala 2020-05-14 08:14:12 UTC 
Statement:

This is essentially a integer overflow in the 'size' variable caused by large data input. In most systems its a signed integer overflow and results in out of bounds buffer write on the heap. However the impact is greatly reduced because such an attack is only possible if the application compiled with json-c is designed to accept untrusted large json files. Also the attack vector in this case as considered as local in most practical cases.
Comment 6 Huzaifa S. Sidhpurwala 2020-05-14 08:25:38 UTC 
Mitigation:

Since this flaw is triggered by untrusted large json files. If any applications linked against json-c is used ensure that the application does not accept large json files. (or untrusted ones wherever possible)
Comment 7 Björn 'besser82' Esser 2020-05-14 10:46:09 UTC 
Can you please open a tracking bug for the `json-c12` package in EPEL {6,7}, too?
Comment 8 Björn 'besser82' Esser 2020-05-14 14:35:59 UTC 
Rawhide already ships the fix with NVR `json-c-0.14-3.fc33`.  Updates for Fedora 3{2,1,0} have been submitted.
Comment 9 Marian Rehak 2020-05-15 12:53:03 UTC 
Created json-c12 tracking bugs for this issue:

Affects: epel-6 [bug 1836219]
Affects: epel-7 [bug 1836220]
Comment 10 Björn 'besser82' Esser 2020-05-15 20:24:04 UTC 
Updates for epel-{6,7} have been submitted.
Comment 11 Björn 'besser82' Esser 2020-05-15 20:26:22 UTC 
You can find fully working backports of the needed fixes here:

  * json-c-0.14:    https://github.com/json-c/json-c/pull/608
  * json-c-0.13.x:  https://github.com/json-c/json-c/pull/607
  * json-c-0.12.x:  https://github.com/json-c/json-c/pull/611
  * json-c-0.11:    https://github.com/json-c/json-c/pull/612
  * json-c-0.10:    https://github.com/json-c/json-c/pull/613
Comment 12 Product Security DevOps Team 2021-11-09 17:51:56 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-12762
Comment 13 errata-xmlrpc 2021-11-09 18:32:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4382 https://access.redhat.com/errata/RHSA-2021:4382
Note You need to log in before you can comment on or make changes to this bug.