774471 – (CVE-2021-3420) <sys-libs/newlib-4.0.0: heap buffer overflow vulnerability (CVE-2021-3420)

Bug 774471 (CVE-2021-3420) - <sys-libs/newlib-4.0.0: heap buffer overflow vulnerability (CVE-2021-3420)

Summary: <sys-libs/newlib-4.0.0: heap buffer overflow vulnerability (CVE-2021-3420)

Status:	RESOLVED FIXED

Alias:	CVE-2021-3420

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal trivial (vote)
Assignee:	Gentoo Security

URL:
Whiteboard:	~4 [noglsa]
Keywords:

Depends on:
Blocks:

Reported:	2021-03-06 15:34 UTC by John Helmert III
Modified:	2021-03-07 15:20 UTC (History)
CC List:	2 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2021-03-06 15:34:03 UTC

CVE-2021-3420:

A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions mEMALIGn, pvALLOc, nano_memalign, nano_valloc, nano_pvalloc could case an integer overflow, leading to an allocation of a small buffer and then to a heap-based buffer overflow.

Patch: https://sourceware.org/git/?p=newlib-cygwin.git;a=commit;h=aa106b29a6a8a1b0df9e334704292cbc32f2d44e


Please cleanup.

Comment 1 Larry the Git Cow gentoo-dev

2021-03-06 19:31:11 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5c22741a8324665e9caafb2b9342f9908945760a

commit 5c22741a8324665e9caafb2b9342f9908945760a
Author:     Sergei Trofimovich <slyfox@gentoo.org>
AuthorDate: 2021-03-06 19:30:37 +0000
Commit:     Sergei Trofimovich <slyfox@gentoo.org>
CommitDate: 2021-03-06 19:31:07 +0000

    sys-libs/newlib: drop old
    
    Bug: https://bugs.gentoo.org/774471
    Package-Manager: Portage-3.0.16, Repoman-3.0.2
    Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>

 sys-libs/newlib/Manifest               |   2 -
 sys-libs/newlib/newlib-3.3.0-r1.ebuild | 154 ---------------------------------
 sys-libs/newlib/newlib-3.3.0.ebuild    | 150 --------------------------------
 sys-libs/newlib/newlib-4.0.0.ebuild    | 154 ---------------------------------
 4 files changed, 460 deletions(-)

Comment 2 John Helmert III archtester

2021-03-07 15:20:34 UTC

Thank you! All done.