[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 21 Dec 2012 23:54:10 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: coley@...us.mitre.org, oss-security@...ts.openwall.com,
security@...ntu.com, eggert@...ucla.edu
Subject: Re: CVE Request: grep
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 12/21/2012 05:19 PM, Seth Arnold wrote:
> Hello Kurt, Steve, all.
>
> Paul, I've included you on Cc: to help determine if several grep
> patches are security-relevant.
>
> A bug reporter [1] that claims he has, or can produce, a code
> execution exploit against grep < 2.11. I've verified that our grep
> 2.10 package segfaults on the amd64 platform with the simple
> reproducer:
>
> $ perl -e 'print "x"x(2**31)' | grep x > /dev/null Segmentation
> fault (core dumped)
Confirmed it segfaults. Would it be possible to get a reproducer for
this issue?
Please use CVE-2012-5667 for this issue.
> This specific problem was patched [2] with the following checkin:
> http://git.savannah.gnu.org/cgit/grep.git/commit/?id=cbbc1a45b9f843c811905c97c90a5d31f8e6c189
>
> This checkin adds this text to the NEWS file:
>
> + grep no longer dumps core on lines whose lengths do not fit in
> 'int'. + (e.g., lines longer than 2 GiB on a typical 64-bit host).
> + Instead, grep either works as expected, or reports an error. + An
> error can occur if not enough main memory is available, or if the +
> GNU C library's regular expression functions cannot handle such
> long lines. + [bug present since "the beginning"]
>
> Please assign a CVE number for this problem.
>
>
> Several other checkins around the 2.11 timeframe also look like
> they may be security-relevant:
>
> PCRE over-long line fix:
> http://git.savannah.gnu.org/cgit/grep.git/commit/?id=4572ea4649d025e51463d48c2d06a1c66134cdb8
>
> Integer overflow issues:
> http://git.savannah.gnu.org/cgit/grep.git/commit/?id=8fcf61523644df42e1905c81bed26838e0b04f91
>
> Paul, are any security issues fixed with those patches? Did I
> overlook any other patches that need CVE numbers?
>
> Thanks
>
>
> 1: https://bugs.launchpad.net/ubuntu/+source/grep/+bug/1091473 2:
> http://lists.gnu.org/archive/html/bug-grep/2012-12/msg00004.html
>
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBAgAGBQJQ1VkRAAoJEBYNRVNeJnmTqekP/2R36xFvohg+1L/l+7yv+HwU
FKCCSJvCg7N631ndjdD6Dhau4uqml+3n5gh11FywOTFpaOnD7BsYlYtTIMJWRU+4
PwnJlAmO+HVIXUiTYUQN0tI6MODeP56KLErtgg9AIveNYkXHT5jo6MrCcOL34Atx
vWhgSL0f3thh25ckqQ9DvhFgDPjAfF6HJGoazeucFegI86OehpcADl3fkFP6vMgN
yiyaHKZIk2r8e+nsKf12DGY6KJId4w0OQnUrqGWuYMSN8OTgKTRH6iBXN9t95zOz
F12mFGtE5VYTG9CPqJN0ZRgyyRdh13A9O417IVKtGTsdpJ1pbWqI4xmn3PM0WT3k
2DBzlIBNNsMxSAxTldT3C8LPj5OPfeR6H9FMGQLeXJBcKp4/C1DWkJrrbia1fN6X
uxdlJkL4mY6PXS9NL6oyMelZRSMt4PQMAZLS1z/YglN8uRg2gTjJ0hDeot1GFtoV
QisVhCQ1HxeiFtZKrelotqob83SL8X81RdyJPj/2ZGmUbbCYqpflNh8f8de6G7Sq
fy1+KhktDvoe+qoaMj+0mIDvbgpVOmSOgUS9T0wmj5rsgyTbdhRFv3ZMxX2A236b
0bWvPA60Qn4Evk9g9SDVYxzR8hBoGN7uEXsaKCUUe3YSFhlNUCEOshSL+B+/qPxU
PQXw12/M6G4634ypTuc5
=zdi0
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
