An integer overflow leading to a heap-based buffer overflow was found in the way grep, A utility used to search through textual input for lines which contain a match to a specified pattern, parsed large lines of data. This flaw could use used to crash grep or potentially execute arbitrary code, if a local user was tricked into running grep on a specially crafted data file. Patch: http://git.savannah.gnu.org/cgit/grep.git/commit/?id=cbbc1a45b9f843c811905c97c90a5d31f8e6c189 Reference: http://seclists.org/oss-sec/2012/q4/504
Upstream suggests that this issue only affects grep < 2.11
This issue affects the version of grep package as shipped with Fedora-16. This issue does NOT affect the version of grep package as shipped with Fedora-17.
(Other) References: ------------------- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5667 http://lists.gnu.org/archive/html/bug-grep/2012-12/msg00004.html http://openwall.com/lists/oss-security/2012/12/22/6 http://git.savannah.gnu.org/cgit/grep.git/commit/?id=8fcf61523644df42e1905c81bed26838e0b04f91 http://git.savannah.gnu.org/cgit/grep.git/commit/?id=cbbc1a45b9f843c811905c97c90a5d31f8e6c189 http://git.sv.gnu.org/gitweb/?p=grep.git;a=shortlog;h=v2.11 https://bugs.launchpad.net/ubuntu/+source/grep/+bug/1091473
I am unable to reproduce the crash on F16. 64 bit machine with 4 GB RAM: # perl -e 'print "x"x(2**31)' | grep x > /dev/null grep: memory exhausted # grep --version grep (GNU grep) 2.9
Statement: This issue did not affect the version of grep as shipped with Red Hat Enterprise Linux 5.
Created attachment 686585 [details] Proposed fix This is proposed fix/workaround for the problem. It is not clean solution, but it shouldn't have side-effects.
Created attachment 686605 [details] Proposed fix (to cover boundary case) # perl -e 'print "x"x(1073741823)' | LANG=c grep x > /dev/null # perl -e 'print "x"x(1073741824)' | LANG=c grep x > /dev/null grep: line too long
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2015:1447 https://rhn.redhat.com/errata/RHSA-2015-1447.html