Bug 1998315 (CVE-2020-18974) - CVE-2020-18974 nasm: buffer overflow in crc64i() nasmlib/crc64.c
Summary: CVE-2020-18974 nasm: buffer overflow in crc64i() nasmlib/crc64.c
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2020-18974
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1998317 2003200 2003201
Blocks: 1998318
TreeView+ depends on / blocked
 
Reported: 2021-08-26 19:46 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-11-19 14:38 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-11-19 14:38:32 UTC
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2021-08-26 19:46:47 UTC 
Buffer Overflow in Netwide Assembler (NASM) v2.15.xx allows attackers to cause a denial of service via 'crc64i' in the component 'nasmlib/crc64'. This issue is different than CVE-2019-7147.

Reference:
https://bugzilla.nasm.us/show_bug.cgi?id=3392568
Comment 1 Guilherme de Almeida Suckevicz 2021-08-26 19:47:03 UTC 
Created nasm tracking bugs for this issue:

Affects: fedora-all [bug 1998317]
Comment 6 Marco Benatto 2021-09-13 15:52:41 UTC 
There's an issue with nasm where a crafted input file may lead to a out-of-bounds read during crc64 calculation. The OOB read may further trigger a crash on nasm. The impact of this issue is pretty low as user interaction is required by making the user open the crafted file and it'll affect only the single run of the single application instanced started by the user.
Note You need to log in before you can comment on or make changes to this bug.