Bug 714948

Summary:	sys-boot/grub: Possible multiple vulnerabilities due to embedded gnulib (CVE-2017-7476, CVE-2018-17942)
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED INVALID
Severity:	normal	CC:	base-system, floppym
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	714934

Description Sam James archtester

2020-03-26 23:02:06 UTC

It is suspected that this package is vulnerable to a security vulnerability in gnulib. As such we ask maintainers with packages suspected to be vulnerable to verify if the package is (or have been) affected. 

Please see the information contained in the tracker bug 714934:
*  CVE-2017-7476 - "Gnulib before 2017-04-26 has a heap-based buffer overflow with the TZ environment variable. The error is in the save_abbr function in time_rz.c."

** Patch: https://git.savannah.gnu.org/gitweb/?p=gnulib.git;a=commit;h=94e01571507835ff59dd8ce2a0b56a4b566965a4

* CVE-2018-17942 - "The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\0' character during %f processing."

** Patch: https://git.savannah.gnu.org/gitweb/?p=gnulib.git;a=commit;h=278b4175c9d7dd47c1a3071554aac02add3b3c35

If neither of these functions are used and haven't been in the past, you should be fine.

Please check if possible whether any embedded gnulib has now, or in the past (for GLSA purposes/cleanup if still in tree) contained in this version.

Comment 1 Mike Gilbert gentoo-dev

2020-03-27 02:46:27 UTC

I see no evidence that grub has ever used the save_abbr or convert_to_decimal functions.

Comment 2 Sam James archtester

2020-03-27 05:56:53 UTC

(In reply to Mike Gilbert from comment #1)
> I see no evidence that grub has ever used the save_abbr or
> convert_to_decimal functions.

Agreed.