Bug 91817 - dev-libs/elfutils: heap overflow
Bug#: 91817 Product:  Gentoo Security Version: unspecified Platform: All
OS/Version: All Status: RESOLVED Severity: normal Priority: P2
Resolution: FIXED Assigned To: security@gentoo.org Reported By: taviso@gentoo.org
Component: Vulnerabilities
URL: 
Summary: dev-libs/elfutils: heap overflow
Keywords:  
Status Whiteboard: B2 [glsa] jaervosz
Opened: 2005-05-07 10:34 0000
Description:   Opened: 2005-05-07 10:34 0000 
see bug 91398 for details and testcase, elfutils is vulnerable to the same heap
overflow.

the same fix used in bfd can be tweaked and applied, looks like the allocation
happens around line 228 of elf_begin.c

  /* Determine the number of sections.  */
...
  /* We can now allocate the memory.  */
  elf = allocate_elf (fildes, map_address, offset, maxsize, cmd, parent,
              ELF_K_ELF, scncnt * sizeof (Elf_Scn));

------- Comment #1 From Tavis Ormandy (RETIRED) 2005-05-07 10:36:22 0000 ------- 
applying the same sanity test to the "scncnt * sizeof (Elf_Scn)" calculation
should fix it.

------- Comment #2 From Tavis Ormandy (RETIRED) 2005-05-07 10:50:20 0000 ------- 
Created an attachment (id=58287) [details]
heap overflow patch

eu-readelf -a fails the testcase gracefully with this patch.

------- Comment #3 From Tavis Ormandy (RETIRED) 2005-05-12 13:36:52 0000 ------- 
elfutils-0.94-r2 contains the patch.

------- Comment #4 From Thierry Carrez (RETIRED) 2005-05-13 01:37:19 0000 ------- 
Arches, please test and mark stable 0.94-r2 or 0.97-r1, at your choice.

------- Comment #5 From Michael Hanselmann (hansmi) (RETIRED) 2005-05-13 05:03:33 0000 ------- 
Stable on ppc.

------- Comment #6 From Jan Brinkmann (RETIRED) 2005-05-13 05:12:19 0000 ------- 
0.94-r2 stable on amd64

------- Comment #7 From Gustavo Zacarias (RETIRED) 2005-05-13 06:25:25 0000 ------- 
0.94-r2 sparc stable.

------- Comment #8 From René Nussbaumer 2005-05-13 08:17:42 0000 ------- 
Stable on hppa

------- Comment #9 From Olivier Crete 2005-05-14 10:52:04 0000 ------- 
x86 stable. I went with 0.94-r2 too out of sheer conservatism

------- Comment #10 From Markus Rothe 2005-05-15 05:23:59 0000 ------- 
stable on ppc64

------- Comment #11 From Bryan Østergaard (RETIRED) 2005-05-15 07:16:22 0000 ------- 
Stable on alpha + ia64.

------- Comment #12 From solar 2005-05-17 04:23:18 0000 ------- 
Created an attachment (id=59110) [details]
elfutils-0.108-robustify.patch

Jakub Jelinek (upstream) provides the following patch to address this and other
problems. I think it obsoletes the previous patch but I'm not sure yet.

------- Comment #13 From solar 2005-05-17 09:16:59 0000 ------- 
0.108 is in the tree.

------- Comment #14 From solar 2005-05-17 10:42:32 0000 ------- 
added additional 0.108 incremental patch from Jakub which solves remaining 
regression failure with elfutils that we found.
This version or a 0.109 is what arches will want to mark stable in general if you 
want to use upstream fixes.

------- Comment #15 From Sune Kloppenborg Jeppesen 2005-05-19 07:57:49 0000 ------- 
Arches please test and mark 0.108 stable.

------- Comment #16 From Yuta SATOH (RETIRED) 2005-05-19 10:48:18 0000 ------- 
Stable on ppc64

------- Comment #17 From Michael Hanselmann (hansmi) (RETIRED) 2005-05-19 10:48:41 0000 ------- 
Stable on ppc.

------- Comment #18 From René Nussbaumer 2005-05-19 10:55:43 0000 ------- 
Stable on hppa

------- Comment #19 From Jan Brinkmann (RETIRED) 2005-05-19 10:58:06 0000 ------- 
stable on amd64

------- Comment #20 From Gustavo Zacarias (RETIRED) 2005-05-19 11:07:48 0000 ------- 
sparc stable.

------- Comment #21 From Bryan Østergaard (RETIRED) 2005-05-20 11:49:54 0000 ------- 
Stable on alpha + ia64.

------- Comment #22 From Olivier Crete 2005-05-22 14:25:15 0000 ------- 
sorry for the delay.. stable on x86.. we really need more people on x86@

------- Comment #23 From Thierry Carrez (RETIRED) 2005-05-29 03:17:44 0000 ------- 
Waiting for binutils to be ready

------- Comment #24 From solar 2005-06-01 05:48:22 0000 ------- 
Removed the old vuln ebuilds for the sake the the GLSA itself. 
All arches minus mips are currently marked stable.

------- Comment #25 From Sune Kloppenborg Jeppesen 2005-06-01 08:31:54 0000 ------- 
GLSA 200506-01 
 
mips please remember to mark stable.

------- Comment #26 From Hardave Riar (RETIRED) 2005-07-02 14:48:13 0000 ------- 
Stable on mips.