Bug 1927559 (CVE-2021-27135) - CVE-2021-27135 xterm: crash when processing combining characters
Summary: CVE-2021-27135 xterm: crash when processing combining characters
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-27135
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1927564 1927565 1927566 1927567 1927568 1927569 1927570
Blocks: 1927561
TreeView+ depends on / blocked
 
Reported: 2021-02-11 01:13 UTC by Doran Moppert
Modified: 2022-04-17 21:08 UTC (History)
1 user (show)

Fixed In Version: xterm 366
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in xterm. A specially crafted sequence of combining characters causes an out of bounds write leading to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Clone Of:
Environment:
Last Closed: 2021-02-18 19:02:54 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:0611 0 None None None 2021-02-18 14:54:28 UTC
Red Hat Product Errata RHSA-2021:0617 0 None None None 2021-02-22 11:12:15 UTC
Red Hat Product Errata RHSA-2021:0650 0 None None None 2021-02-24 07:45:27 UTC
Red Hat Product Errata RHSA-2021:0651 0 None None None 2021-02-24 07:54:51 UTC

Description Doran Moppert 2021-02-11 01:13:00 UTC 
A crash was reported in xterm prior to patch #366 when processing a specially crafted sequence of combining characters.  The cause is an out of bounds write, which may be exploitable to cause arbitrary code execution.

https://www.openwall.com/lists/oss-security/2021/02/09/7
https://invisible-island.net/xterm/xterm.log.html
Comment 1 Doran Moppert 2021-02-11 01:24:06 UTC 
Created xterm tracking bugs for this issue:

Affects: fedora-all [bug 1927570]
Comment 4 Doran Moppert 2021-02-11 02:57:29 UTC 
Mitigation:

This vulnerability can be mitigated by disabling UTF-8 support in XTerm configuration.  An entry such as "XTerm.vt100.utf8: false" in Xresources will disable UTF-8.  This can be set as a system default in /etc/X11/Xresources, or per-user in ~/.Xresources.

Note that this setting can still be overridden if xterm is invoked with the "-u8" command line option, so the mitigation may not protect all use cases.
Comment 5 errata-xmlrpc 2021-02-18 14:54:27 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:0611 https://access.redhat.com/errata/RHSA-2021:0611
Comment 6 Product Security DevOps Team 2021-02-18 19:02:54 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-27135
Comment 7 errata-xmlrpc 2021-02-22 11:12:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:0617 https://access.redhat.com/errata/RHSA-2021:0617
Comment 8 errata-xmlrpc 2021-02-24 07:45:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:0650 https://access.redhat.com/errata/RHSA-2021:0650
Comment 9 errata-xmlrpc 2021-02-24 07:54:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:0651 https://access.redhat.com/errata/RHSA-2021:0651
Note You need to log in before you can comment on or make changes to this bug.