Bug 1929847 (CVE-2021-27218) - CVE-2021-27218 glib: integer overflow in g_byte_array_new_take function when called with a buffer of 4GB or more on a 64-bit platform
Summary: CVE-2021-27218 glib: integer overflow in g_byte_array_new_take function when ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-27218
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1941698 1941699 1941700 1929848 1929849 1929850 1929851 1939072 1939073 1939074 1939075 1939076 1941679 1941680 1941681 1941682 1941684 1941685 1941701 1974886 1974887 1974888
Blocks: 1929863
TreeView+ depends on / blocked
 
Reported: 2021-02-17 19:00 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-09-26 18:21 UTC (History)
28 users (show)

Fixed In Version: glib 2.66.7, glib 2.67.4
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-08-10 13:28:11 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:3058 0 None None None 2021-08-10 13:15:10 UTC
Red Hat Product Errata RHSA-2021:4526 0 None None None 2021-11-09 19:06:50 UTC

Description Guilherme de Almeida Suckevicz 2021-02-17 19:00:18 UTC 
An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.

References:
https://gitlab.gnome.org/GNOME/glib/-/merge_requests/1942
https://gitlab.gnome.org/GNOME/glib/-/merge_requests/1944
Comment 1 Guilherme de Almeida Suckevicz 2021-02-17 19:00:52 UTC 
Created glib tracking bugs for this issue:

Affects: epel-7 [bug 1929851]
Affects: fedora-all [bug 1929848]


Created glib2 tracking bugs for this issue:

Affects: fedora-all [bug 1929849]


Created mingw-glib2 tracking bugs for this issue:

Affects: fedora-all [bug 1929850]
Comment 5 Riccardo Schirone 2021-05-13 15:41:15 UTC 
This issue is about an integer truncation that occurs only when an application uses g_byte_array_new_take (or inderectly uses it, like with g_bytes_unref_to_array), provides a way for an attacker to provide both size and data and that could lead to at most an impact on the availability of the application/service. Moreover, if the application correctly uses the array->len field to determine the size of the GBytesArray, where array is the GBytesArray returned by g_byte_array_new_take/g_bytes_unref_to_array, no other direct security problem could happen because the stored length is less than what initially was. For these reason, this flaw got a Moderate Impact.
Comment 10 errata-xmlrpc 2021-08-10 13:15:07 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:3058 https://access.redhat.com/errata/RHSA-2021:3058
Comment 11 Product Security DevOps Team 2021-08-10 13:28:11 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-27218
Comment 12 errata-xmlrpc 2021-11-09 19:06:48 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4526 https://access.redhat.com/errata/RHSA-2021:4526
Note You need to log in before you can comment on or make changes to this bug.