Bug 645859 (CVE-2010-4051, CVE-2010-4052) - CVE-2010-4051 CVE-2010-4052 glibc: De-recursivise regular expression engine
Summary: CVE-2010-4051 CVE-2010-4052 glibc: De-recursivise regular expression engine
Alias: CVE-2010-4051, CVE-2010-4052
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On:
TreeView+ depends on / blocked
Reported: 2010-10-22 17:01 UTC by Jan Lieskovsky
Modified: 2021-02-24 17:12 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2011-06-03 09:40:49 UTC

Attachments (Terms of Use)

Description Jan Lieskovsky 2010-10-22 17:01:05 UTC
Maksymilian Arciemowicz reported a deficiency in the way
glibc regular expression engine processed certain patterns.
A local attacker could use this flaw to cause a denial of 
service (crash due stack overflow).

Note: The above described behavior is a limitation of glibc
regular expression engine. Regular expression matching 
function is called recursively for certain types of patterns 
(where subexpression using quantifier is nested inside of 
another quantified expression), where long input can result 
in deep recursion and exhaustion of all stack memory (i.e. 
impact is limited to crash). Amount of stack memory available
to glibc regular expression engine influences the size of input 
that must be provided to trigger the crash. Alternatively, 
expression can be modified to avoid quantification nesting, 
or program modified to limit size of input passed to regular
expression engine.

Conclusion: Due the above described behavior Red Hat Security
Response Team would not classify this deficiency to be a security

[1] http://www.kb.cert.org/vuls/id/912279
[2] http://www.securityfocus.com/archive/1/515589
[3] http://forums.cnet.com/7726-6132_102-5042238.html
[4] http://secunia.com/advisories/42547/
[5] http://securityreason.com/securityalert/8003

Comment 3 Jan Lieskovsky 2010-11-30 14:09:20 UTC
The CVE identifier of CVE-2010-4051 has been assigned for
the crash due large values in an "{n,}" sequence issue.

The CVE identifier of CVE-2010-4052 has been assigned
for the stack exhaustion issue.

Comment 5 Jan Lieskovsky 2011-01-10 15:40:18 UTC
Full-disclosure post:
[1] http://seclists.org/fulldisclosure/2011/Jan/78

Comment 6 Jan Lieskovsky 2011-01-10 16:00:23 UTC

Red Hat does not consider crash of client application, using regcomp() 
or regexec() routines on untrusted input without preliminary checking 
the input for the sanity, to be a security issue (the described deficiency 
implies and is a known limitation of the glibc regular expression engine 
implementation). The expressions can be modified to avoid quantification 
nesting, or program modified to limit size of input passed to regular 
expression engine. We do not currently plan to fix these flaws. If more 
information becomes available at a future date, we may revisit these issues.

Comment 11 Jan Lieskovsky 2011-06-03 09:22:30 UTC
These issues affect the versions of the glibc package, as shipped with
Red Hat Enterprise Linux 4, 5, and 6.

Comment 13 Jan Lieskovsky 2011-06-03 09:40:49 UTC
Closing as not a bug due conclusion in:
[1] https://bugzilla.redhat.com/show_bug.cgi?id=645859#c6

Note You need to log in before you can comment on or make changes to this bug.