Bug 1949687 (CVE-2021-3504) - CVE-2021-3504 hivex: Buffer overflow when provided invalid node key length
Summary: CVE-2021-3504 hivex: Buffer overflow when provided invalid node key length
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-3504
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1950500 1950501 1950917 1952988 1956204 1957103
Blocks: 1949688 1950347
TreeView+ depends on / blocked
 
Reported: 2021-04-14 19:48 UTC by Pedro Sampaio
Modified: 2022-04-17 21:18 UTC (History)
4 users (show)

Fixed In Version: hivex-1.3.20
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the hivex library. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to crash. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed: 2021-06-01 07:35:22 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:2318 0 None None None 2021-06-08 22:33:21 UTC
Red Hat Product Errata RHSA-2021:3061 0 None None None 2021-08-10 13:50:32 UTC

Description Pedro Sampaio 2021-04-14 19:48:38 UTC 
A flaw was found in libhivex. It's possible to provide a large length value for a node which can read past the end of the file leading to read of arbitrary memory and other potential consequences.
Comment 21 gkamathe 2021-04-20 07:27:42 UTC 
Statement:

This flaw affects all previous hivex versions up to version 1.3.19
Comment 24 gkamathe 2021-05-03 08:05:50 UTC 
Upstream fix: https://github.com/libguestfs/hivex/commit/8f1935733b10d974a1a4176d38dd151ed98cf381
Comment 25 gkamathe 2021-05-03 08:08:15 UTC 
Created hivex tracking bugs for this issue:

Affects: fedora-all [bug 1956204]
Comment 27 gkamathe 2021-05-12 13:15:56 UTC 
Mitigation:

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Comment 28 errata-xmlrpc 2021-06-08 22:33:20 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:2318 https://access.redhat.com/errata/RHSA-2021:2318
Comment 30 errata-xmlrpc 2021-08-10 13:50:29 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:3061 https://access.redhat.com/errata/RHSA-2021:3061
Note You need to log in before you can comment on or make changes to this bug.