Bug 767718 – <sys-libs/glibc-2.32-r8: multiple vulnerabilities (CVE-2020-27618, CVE-2021-3326)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2021-01-28 02:52:01 UTC]

CVE-2021-3326:

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=27256
Patch: https://sourceware.org/pipermail/libc-alpha/2021-January/122058.html

[Comment 1 Sam James 2021-01-28 03:02:28 UTC]

This will be in 2.33 which is out shortly but obviously we won't be stabling that for a while.

[Comment 2 John Helmert III 2021-02-27 02:24:39 UTC]

CVE-2020-27618 (https://sourceware.org/bugzilla/show_bug.cgi?id=26224):

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.


Also fixed in 2.33.

[Comment 3 Andreas K. Hüttel 2021-02-27 17:21:12 UTC]

(In reply to John Helmert III (ajak) from comment #0)
> CVE-2021-3326:
> 
> The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and
> earlier, when processing invalid input sequences in the ISO-2022-JP-3
> encoding, fails an assertion in the code path and aborts the program,
> potentially resulting in a denial of service.
> 
> Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=27256
> Patch: https://sourceware.org/pipermail/libc-alpha/2021-January/122058.html

fixed in gentoo 2.32 branch, tag gentoo/glibc-2.32-7

(In reply to John Helmert III (ajak) from comment #2)
> CVE-2020-27618 (https://sourceware.org/bugzilla/show_bug.cgi?id=26224):
> 
> The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and
> earlier, when processing invalid multi-byte input sequences in IBM1364,
> IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input
> state, which could lead to an infinite loop in applications, resulting in a
> denial of service, a different vulnerability from CVE-2016-10228.
> 
> 
> Also fixed in 2.33.

fixed in gentoo 2.32 branch, tag gentoo/glibc-2.32-3

[Comment 4 Larry the Git Cow 2021-02-27 19:18:09 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d446edfec1019a14aa3d2bbdbdfb79845b053b0c

commit d446edfec1019a14aa3d2bbdbdfb79845b053b0c
Author:     Andreas K. Hüttel <[e-mail]>
AuthorDate: 2021-02-27 19:17:04 +0000
Commit:     Andreas K. Hüttel <[e-mail]>
CommitDate: 2021-02-27 19:18:01 +0000

    sys-libs/glibc: Bump to 2.32 patchlevel 8
    
    Bug: https://bugs.gentoo.org/767718
    Bug: https://bugs.gentoo.org/768366
    Package-Manager: Portage-3.0.13, Repoman-3.0.2
    Signed-off-by: Andreas K. Hüttel <[e-mail]>

 sys-libs/glibc/Manifest             |    1 +
 sys-libs/glibc/glibc-2.32-r8.ebuild | 1513 +++++++++++++++++++++++++++++++++++
 2 files changed, 1514 insertions(+)

[Comment 5 John Helmert III 2021-02-27 20:17:31 UTC]

Thank you!

[Comment 6 Andreas K. Hüttel 2021-07-01 21:31:10 UTC]

Nothing to do for toolchain here anymore

[Comment 7 John Helmert III 2021-07-05 02:38:32 UTC]

New request filed

[Comment 8 GLSAMaker/CVETool Bot 2021-07-06 03:42:01 UTC]

This issue was resolved and addressed in
 GLSA 202107-07 at https://security.gentoo.org/glsa/202107-07
by GLSA coordinator John Helmert III (ajak).