Bug 1835253 (CVE-2020-12762) - CVE-2020-12762 json-c, libfastjson: integer overflow and out-of-bounds write via a large JSON file
Summary: CVE-2020-12762 json-c, libfastjson: integer overflow and out-of-bounds write ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-12762
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1835255 1835624 1835625 1835626 1836219 1836220 2203170 2203171 2203172
Blocks: 1835256
TreeView+ depends on / blocked
 
Reported: 2020-05-13 13:50 UTC by Guilherme de Almeida Suckevicz
Modified: 2024-02-02 16:22 UTC (History)
11 users (show)

Fixed In Version: json-c-0.14-3.fc33, libfastjson 0.99.9.1
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in json-c. In printbuf_memappend, certain crafted values can overflow the memory allowing an attacker to write past the memory boundary. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Clone Of:
Environment:
Last Closed: 2021-11-09 17:51:58 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:4382 0 None None None 2021-11-09 18:32:33 UTC
Red Hat Product Errata RHSA-2023:6431 0 None None None 2023-11-07 08:16:38 UTC
Red Hat Product Errata RHSA-2023:6976 0 None None None 2023-11-14 15:18:20 UTC
Red Hat Product Errata RHSA-2024:0411 0 None None None 2024-01-24 16:42:17 UTC
Red Hat Product Errata RHSA-2024:0573 0 None None None 2024-01-30 13:20:52 UTC

Description Guilherme de Almeida Suckevicz 2020-05-13 13:50:32 UTC
json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.

Reference:
https://github.com/json-c/json-c/pull/592

Comment 1 Guilherme de Almeida Suckevicz 2020-05-13 13:50:49 UTC
Created json-c tracking bugs for this issue:

Affects: fedora-all [bug 1835255]

Comment 2 Huzaifa S. Sidhpurwala 2020-05-14 08:13:11 UTC
Upstream patch: https://github.com/json-c/json-c/pull/592/commits/d07b91014986900a3a75f306d302e13e005e9d67

Comment 4 Huzaifa S. Sidhpurwala 2020-05-14 08:14:12 UTC
Statement:

This is essentially a integer overflow in the 'size' variable caused by large data input. In most systems its a signed integer overflow and results in out of bounds buffer write on the heap. However the impact is greatly reduced because such an attack is only possible if the application compiled with json-c is designed to accept untrusted large json files. Also the attack vector in this case as considered as local in most practical cases.

Comment 6 Huzaifa S. Sidhpurwala 2020-05-14 08:25:38 UTC
Mitigation:

Since this flaw is triggered by untrusted large json files. If any applications linked against json-c is used ensure that the application does not accept large json files. (or untrusted ones wherever possible)

Comment 7 Björn 'besser82' Esser 2020-05-14 10:46:09 UTC
Can you please open a tracking bug for the `json-c12` package in EPEL {6,7}, too?

Comment 8 Björn 'besser82' Esser 2020-05-14 14:35:59 UTC
Rawhide already ships the fix with NVR `json-c-0.14-3.fc33`.  Updates for Fedora 3{2,1,0} have been submitted.

Comment 9 Marian Rehak 2020-05-15 12:53:03 UTC
Created json-c12 tracking bugs for this issue:

Affects: epel-6 [bug 1836219]
Affects: epel-7 [bug 1836220]

Comment 10 Björn 'besser82' Esser 2020-05-15 20:24:04 UTC
Updates for epel-{6,7} have been submitted.

Comment 11 Björn 'besser82' Esser 2020-05-15 20:26:22 UTC
You can find fully working backports of the needed fixes here:

  * json-c-0.14:    https://github.com/json-c/json-c/pull/608
  * json-c-0.13.x:  https://github.com/json-c/json-c/pull/607
  * json-c-0.12.x:  https://github.com/json-c/json-c/pull/611
  * json-c-0.11:    https://github.com/json-c/json-c/pull/612
  * json-c-0.10:    https://github.com/json-c/json-c/pull/613

Comment 12 Product Security DevOps Team 2021-11-09 17:51:56 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-12762

Comment 13 errata-xmlrpc 2021-11-09 18:32:32 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4382 https://access.redhat.com/errata/RHSA-2021:4382

Comment 14 TEJ RATHI 2023-05-11 12:17:08 UTC
CVE-2020-12762 also affects libfastjson the same way it affects json-c.

https://github.com/rsyslog/libfastjson/issues/161
https://github.com/rsyslog/libfastjson/pull/166
https://github.com/rsyslog/libfastjson/commit/f51fcd59a8bbeb60eaf8ae0e398556be2fa3317a (0.99.9.1)

Libfastjson is a fork from json-c, but both are different repo. 

Also, as per https://github.com/rsyslog/libfastjson/issues/161#issuecomment-1463424648, the vulnerable code is not substantially different - the affected code is still the same in both. So based on the CVE assignment rules, it's better to go with existing CVE-2020-12762, instead of new one for libfastjson.

Comment 15 TEJ RATHI 2023-05-11 12:18:23 UTC
Created libfastjson tracking bugs for this issue:

Affects: fedora-all [bug 2203170]

Comment 17 errata-xmlrpc 2023-11-07 08:16:35 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6431 https://access.redhat.com/errata/RHSA-2023:6431

Comment 18 errata-xmlrpc 2023-11-14 15:18:17 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:6976 https://access.redhat.com/errata/RHSA-2023:6976

Comment 20 errata-xmlrpc 2024-01-24 16:42:15 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0411 https://access.redhat.com/errata/RHSA-2024:0411

Comment 21 errata-xmlrpc 2024-01-30 13:20:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:0573 https://access.redhat.com/errata/RHSA-2024:0573


Note You need to log in before you can comment on or make changes to this bug.