Bug 2234896 (CVE-2020-35357) - CVE-2020-35357 gsl: Stack buffer overflow in gsl_stats_quantile_from_sorted_data
Summary: CVE-2020-35357 gsl: Stack buffer overflow in gsl_stats_quantile_from_sorted_data
Status: NEW
Alias: CVE-2020-35357
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Product Security
QA Contact:
Depends On: 2243104 2234897 2234898 2234899 2234900
Blocks: 2234901
TreeView+ depends on / blocked
Reported: 2023-08-25 17:44 UTC by Pedro Sampaio
Modified: 2023-10-26 14:12 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A stack buffer overflow flaw was found in the gsl package due to a lack of validation of the user controlled fraction parameter. This issue may allow an attacker to craft malicious input, leading to a segmentation fault and further Denial of Service. Since the buffer overflow happens when reading data from the input array, it's very unlikely to achieve arbitrary code execution using this flaw.
Clone Of:
Last Closed:

Attachments (Terms of Use)

Description Pedro Sampaio 2023-08-25 17:44:07 UTC
A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.



Comment 2 Marco Benatto 2023-10-10 18:34:11 UTC
Created gsl tracking bugs for this issue:

Affects: fedora-all [bug 2243104]

Comment 3 Marco Benatto 2023-10-10 18:41:41 UTC
Upstream commit for this issue:

Comment 4 Marco Benatto 2023-10-10 18:58:55 UTC
The buffer overflow happens at gsl_stats_quantile_from_sorted_data() function from statistics/quantiles_source.c when the `f` parameter is outside the expected value (a fraction between 0 and 1), causing a out-of-bounds read of user-controlled data array parameter in one of following lines:

if (lhs == n - 1)                                                                                
    result = sorted_data[lhs * stride] ;   <--------------------------------------------------------------------------                                                      
    result = (1 - delta) * sorted_data[lhs * stride] + delta * sorted_data[(lhs + 1) * stride] ; <--------------------
as a result the application using the function will crash with a segmentation fault. Since the buffer overflow happens when reading that and the base array is provided by the user, it's very unlikely an attacker could achieve arbitrary code execution.

Note You need to log in before you can comment on or make changes to this bug.