Bug 1927740 (CVE-2021-20248) - CVE-2021-20248 rpm: integer overflow in hdrblobVerifyRegion() in lib/header.c
Summary: CVE-2021-20248 rpm: integer overflow in hdrblobVerifyRegion() in lib/header.c
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2021-20248
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1938103 1912449 1929557
TreeView+ depends on / blocked
 
Reported: 2021-02-11 13:09 UTC by msiddiqu
Modified: 2021-05-12 06:08 UTC (History)
14 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
An integer overflow flaw was found in rpm which can allow undefined behavior. The highest threat from this vulnerability is to data confidentiality, availability and integrity.
Clone Of:
Environment:
Last Closed: 2021-03-11 23:25:49 UTC


Attachments (Terms of Use)
proprosed patch (2.29 KB, patch)
2021-02-13 01:36 UTC, Todd Cullum
no flags Details | Diff

Description msiddiqu 2021-02-11 13:09:17 UTC
Integer overflow in hdrblobVerifyRegion(), if einfo.offset (from the trailer) is INT32_MIN, negating it will overflow, which is undefined behavior.

Comment 1 msiddiqu 2021-02-11 13:09:21 UTC
Acknowledgments:

Name: Demi M. Obenour

Comment 3 Todd Cullum 2021-02-13 01:36:38 UTC
Created attachment 1756741 [details]
proprosed patch

Comment 4 Todd Cullum 2021-02-13 01:37:29 UTC
^ Proposed patch from Demi M. Obenour

Comment 5 Todd Cullum 2021-02-16 19:28:11 UTC
Statement:

rpm as shipped in Red Hat Enterprise Linux is not affected by this flaw, as it only applies on 32-bit systems. Only 64-bit is distributed and supported. Please see https://access.redhat.com/solutions/509373 for more information.

Comment 7 Product Security DevOps Team 2021-03-11 23:25:49 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-20248

Comment 8 Demi Marie Obenour 2021-03-16 22:45:44 UTC
(In reply to Todd Cullum from comment #5)
> Statement:
> 
> rpm as shipped in Red Hat Enterprise Linux is not affected by this flaw, as
> it only applies on 32-bit systems. Only 64-bit is distributed and supported.
> Please see https://access.redhat.com/solutions/509373 for more information.

64-bit systems are also affected; see the attached package.  Git HEAD has already been patched.


Note You need to log in before you can comment on or make changes to this bug.