Bug 1837988 (CVE-2020-10878) - CVE-2020-10878 perl: corruption of intermediate language state of compiled regular expression due to integer overflow leads to DoS
Summary: CVE-2020-10878 perl: corruption of intermediate language state of compiled re...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-10878
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1839275 1839276 1839277 1844663 1929868 1933099 1938329 1972191 1972192
Blocks: 1838017
TreeView+ depends on / blocked
 
Reported: 2020-05-20 10:34 UTC by msiddiqu
Modified: 2021-07-20 22:11 UTC (History)
17 users (show)

Fixed In Version: perl 5.30.3, perl 5.28.3
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-02-02 14:41:41 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:0343 0 None None None 2021-02-02 12:04:30 UTC
Red Hat Product Errata RHSA-2021:0883 0 None None None 2021-03-16 14:56:03 UTC
Red Hat Product Errata RHSA-2021:2792 0 None None None 2021-07-20 22:10:59 UTC

Description msiddiqu 2020-05-20 10:34:23 UTC
This vulnerability is an attacker controlled corruption of the
intermediate language state of a compiled regular expression. The
corruption occurs due to integer overflows in the calculation of offsets
between instructions for the regular expression engine. An attacker
could abuse this behavior to insert instructions into the compiled form
of a Perl regular expression.

Comment 1 msiddiqu 2020-05-20 10:35:33 UTC
Acknowledgments:

Name: Hugo van der Sanden, Slaven Rezic

Comment 11 Petr Pisar 2020-05-25 06:59:03 UTC
(In reply to Todd Cullum from comment #5)
> Mitigation:
> 
> To mitigate this flaw, developers should not pass untrusted or uncontrolled
> data to the Perl regular expression engine; especially in cases where the
> regular expression is used in input sanitization, validation, or filtering.

This flaw is about compiling an untrusted regular expression. Not about a matching an untrusted text.

Comment 12 Todd Cullum 2020-05-27 18:25:54 UTC
Mitigation:

To mitigate this flaw, developers should not allow untrusted regular expressions to be compiled by the Perl regular expression compiler.

Comment 13 Todd Cullum 2020-05-27 21:30:12 UTC
This flaw is caused by code in the Perl regex compiler, which allowed an integer overflow of U16_MAX for certain regular expressions, in regcomp.c's S_study_chunk() or Perl_re_op_compile() routines. The patch locations are different for various affected versions, but involve checking for overflow of U16_MAX. Upstream notes that I32_MAX may be smaller than U16_MAX on some CRAY machines.

Comment 16 msiddiqu 2020-06-06 01:31:39 UTC
Created perl tracking bugs for this issue:

Affects: fedora-all [bug 1844663]

Comment 21 errata-xmlrpc 2021-02-02 12:05:11 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:0343 https://access.redhat.com/errata/RHSA-2021:0343

Comment 22 Product Security DevOps Team 2021-02-02 14:41:41 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-10878

Comment 26 errata-xmlrpc 2021-03-16 14:56:01 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Extended Update Support

Via RHSA-2021:0883 https://access.redhat.com/errata/RHSA-2021:0883

Comment 27 errata-xmlrpc 2021-03-30 09:31:34 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Extended Update Support

Via RHSA-2021:1032 https://access.redhat.com/errata/RHSA-2021:1032

Comment 28 errata-xmlrpc 2021-04-20 12:53:30 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Advanced Update Support
  Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.4 Telco Extended Update Support

Via RHSA-2021:1266 https://access.redhat.com/errata/RHSA-2021:1266

Comment 29 errata-xmlrpc 2021-05-18 14:12:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1678 https://access.redhat.com/errata/RHSA-2021:1678

Comment 34 errata-xmlrpc 2021-07-20 22:11:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:2792 https://access.redhat.com/errata/RHSA-2021:2792


Note You need to log in before you can comment on or make changes to this bug.