Maksymilian Arciemowicz reported a deficiency in the way glibc regular expression engine processed certain patterns. A local attacker could use this flaw to cause a denial of service (crash due stack overflow). Note: The above described behavior is a limitation of glibc regular expression engine. Regular expression matching function is called recursively for certain types of patterns (where subexpression using quantifier is nested inside of another quantified expression), where long input can result in deep recursion and exhaustion of all stack memory (i.e. impact is limited to crash). Amount of stack memory available to glibc regular expression engine influences the size of input that must be provided to trigger the crash. Alternatively, expression can be modified to avoid quantification nesting, or program modified to limit size of input passed to regular expression engine. Conclusion: Due the above described behavior Red Hat Security Response Team would not classify this deficiency to be a security issue. References: [1] http://www.kb.cert.org/vuls/id/912279 [2] http://www.securityfocus.com/archive/1/515589 [3] http://forums.cnet.com/7726-6132_102-5042238.html [4] http://secunia.com/advisories/42547/ [5] http://securityreason.com/securityalert/8003
The CVE identifier of CVE-2010-4051 has been assigned for the crash due large values in an "{n,}" sequence issue. The CVE identifier of CVE-2010-4052 has been assigned for the stack exhaustion issue.
Full-disclosure post: [1] http://seclists.org/fulldisclosure/2011/Jan/78
Statement: Red Hat does not consider crash of client application, using regcomp() or regexec() routines on untrusted input without preliminary checking the input for the sanity, to be a security issue (the described deficiency implies and is a known limitation of the glibc regular expression engine implementation). The expressions can be modified to avoid quantification nesting, or program modified to limit size of input passed to regular expression engine. We do not currently plan to fix these flaws. If more information becomes available at a future date, we may revisit these issues.
These issues affect the versions of the glibc package, as shipped with Red Hat Enterprise Linux 4, 5, and 6.
Closing as not a bug due conclusion in: [1] https://bugzilla.redhat.com/show_bug.cgi?id=645859#c6