Bug 645859 - (CVE-2010-4051, CVE-2010-4052) CVE-2010-4051 CVE-2010-4052 glibc: De-recursivise regular expression engine
CVE-2010-4051 CVE-2010-4052 glibc: De-recursivise regular expression engine
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
public=20101207,reported=20101022,sou...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2010-10-22 13:01 EDT by Jan Lieskovsky
Modified: 2016-02-04 01:47 EST (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2011-06-03 05:40:49 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2010-10-22 13:01:05 EDT
Maksymilian Arciemowicz reported a deficiency in the way
glibc regular expression engine processed certain patterns.
A local attacker could use this flaw to cause a denial of 
service (crash due stack overflow).

Note: The above described behavior is a limitation of glibc
regular expression engine. Regular expression matching 
function is called recursively for certain types of patterns 
(where subexpression using quantifier is nested inside of 
another quantified expression), where long input can result 
in deep recursion and exhaustion of all stack memory (i.e. 
impact is limited to crash). Amount of stack memory available
to glibc regular expression engine influences the size of input 
that must be provided to trigger the crash. Alternatively, 
expression can be modified to avoid quantification nesting, 
or program modified to limit size of input passed to regular
expression engine.

Conclusion: Due the above described behavior Red Hat Security
Response Team would not classify this deficiency to be a security
issue.

References:
[1] http://www.kb.cert.org/vuls/id/912279
[2] http://www.securityfocus.com/archive/1/515589
[3] http://forums.cnet.com/7726-6132_102-5042238.html
[4] http://secunia.com/advisories/42547/
[5] http://securityreason.com/securityalert/8003
Comment 3 Jan Lieskovsky 2010-11-30 09:09:20 EST
The CVE identifier of CVE-2010-4051 has been assigned for
the crash due large values in an "{n,}" sequence issue.

The CVE identifier of CVE-2010-4052 has been assigned
for the stack exhaustion issue.
Comment 5 Jan Lieskovsky 2011-01-10 10:40:18 EST
Full-disclosure post:
[1] http://seclists.org/fulldisclosure/2011/Jan/78
Comment 6 Jan Lieskovsky 2011-01-10 11:00:23 EST
Statement:

Red Hat does not consider crash of client application, using regcomp() 
or regexec() routines on untrusted input without preliminary checking 
the input for the sanity, to be a security issue (the described deficiency 
implies and is a known limitation of the glibc regular expression engine 
implementation). The expressions can be modified to avoid quantification 
nesting, or program modified to limit size of input passed to regular 
expression engine. We do not currently plan to fix these flaws. If more 
information becomes available at a future date, we may revisit these issues.
Comment 11 Jan Lieskovsky 2011-06-03 05:22:30 EDT
These issues affect the versions of the glibc package, as shipped with
Red Hat Enterprise Linux 4, 5, and 6.
Comment 13 Jan Lieskovsky 2011-06-03 05:40:49 EDT
Closing as not a bug due conclusion in:
[1] https://bugzilla.redhat.com/show_bug.cgi?id=645859#c6

Note You need to log in before you can comment on or make changes to this bug.