Bug 1927742 - rpm: integer overflow in hdrblobVerifyRegion()
Summary: rpm: integer overflow in hdrblobVerifyRegion()
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1912449 1929558 1938095
TreeView+ depends on / blocked
 
Reported: 2021-02-11 13:09 UTC by msiddiqu
Modified: 2021-06-23 08:58 UTC (History)
13 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2021-03-11 23:25:54 UTC
Embargoed:

Attachments (Terms of Use)
Proposed patch provided by Demi M. Obenour. (1.05 KB, application/mbox)
2021-02-24 00:37 UTC, Todd Cullum 		no flags Details
View All

Description msiddiqu 2021-02-11 13:09:58 UTC 
 A potential integer overflow in hdrblobVerifyRegion() if einfo.offset exceeds SIZE_MAX - REGION_TAG_COUNT. This is only possible on 32-bit systems.
Comment 1 msiddiqu 2021-02-11 13:10:01 UTC 
Acknowledgments:

Name: Demi M. Obenour
Comment 3 Todd Cullum 2021-02-16 19:28:26 UTC 
Statement:

rpm as shipped in Red Hat Enterprise Linux is not affected by this flaw, as it only applies on 32-bit systems. Only 64-bit is distributed and supported. Please see https://access.redhat.com/solutions/509373 for more information.
Comment 5 Todd Cullum 2021-02-24 00:37:27 UTC 
Created attachment 1758969 [details]
Proposed patch provided by Demi M. Obenour.
Comment 6 Product Security DevOps Team 2021-03-11 23:25:54 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-20249
Note You need to log in before you can comment on or make changes to this bug.