Bug 799785 – dev-libs/keystone: multiple vulnerabilities (CVE-2020-{36404,36405})

• Status: CONFIRMED
• Product: Gentoo Security

[Description John Helmert III 2021-07-02 01:30:43 UTC]

CVE-2020-36404 (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22371):

Keystone Engine 0.9.2 has an invalid free in llvm_ks::SmallVectorImpl<llvm_ks::MCFixup>::~SmallVectorImpl.

CVE-2020-36405 (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22850):

Keystone Engine 0.9.2 has a use-after-free in llvm_ks::X86Operand::getToken.


Need to investigate closer whether these are fixed, the oss-fuzz marked them
as fixed by the marked commits didn't seem relevant.

[addCollapseLink(1, 1, 'Toggle comment display'); Comment 1 NATTkA bot 2021-07-29 17:21:13 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(2, 1, 'Toggle comment display'); Comment 2 NATTkA bot 2021-07-29 17:29:22 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(3, 1, 'Toggle comment display'); Comment 3 NATTkA bot 2021-07-29 17:37:19 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(4, 1, 'Toggle comment display'); Comment 4 NATTkA bot 2021-07-29 17:45:25 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(5, 1, 'Toggle comment display'); Comment 5 NATTkA bot 2021-07-29 17:53:30 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(6, 1, 'Toggle comment display'); Comment 6 NATTkA bot 2021-07-29 18:01:23 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[Comment 7 NATTkA bot 2021-07-29 18:09:45 UTC]

Package list is empty or all packages have requested keywords.

[Comment 8 Anton Bolshakov 2022-01-31 01:14:04 UTC]

upstream bug report:
https://github.com/keystone-engine/keystone/issues/516

[Comment 9 John Helmert III 2022-08-18 17:25:04 UTC]

I've reported the incorrect fix report to upstream: https://github.com/google/oss-fuzz/issues/8283