Bug 719134 (CVE-2018-9838) – <dev-lang/ocaml-4.09.0: Integer overflow (CVE-2018-9838)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Sam James 2020-04-23 22:39:07 UTC]

Description:
"The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted object."

[Comment 1 Sam James 2020-06-20 02:10:23 UTC]

ping

[Comment 2 Aaron Bauman (RETIRED) 2020-07-26 22:33:13 UTC]

sparc was missed...

[Comment 3 GLSAMaker/CVETool Bot 2020-07-27 01:27:24 UTC]

This issue was resolved and addressed in
 GLSA 202007-48 at https://security.gentoo.org/glsa/202007-48
by GLSA coordinator Sam James (sam_c).

[Comment 4 Sam James 2020-07-27 01:28:45 UTC]

(In reply to GLSAMaker/CVETool Bot from comment #3)
> This issue was resolved and addressed in
>  GLSA 202007-48 at https://security.gentoo.org/glsa/202007-48
> by GLSA coordinator Sam James (sam_c).

Reopening for sparc stabilisation.

[addCollapseLink(5, 1, 'Toggle comment display'); Comment 5 NATTkA bot 2020-07-27 17:29:01 UTC Comment hidden (obsolete)]

Resetting sanity check; keywords are not fully specified and arches are not CC-ed.

[Comment 6 Mark Purtill 2020-07-27 22:03:57 UTC]

On a stable system, one can't update dev-lang/ocaml-4.09.0 without unmasking dev-ml/ocamlbuild-0.14.0 and possibly some other packages.  See this forum thread:

<https://forums.gentoo.org/viewtopic-t-1114522-highlight-ocaml.html>

[Comment 7 Sam James 2020-10-17 01:55:06 UTC]

(In reply to Mark Purtill from comment #6)
> On a stable system, one can't update dev-lang/ocaml-4.09.0 without unmasking
> dev-ml/ocamlbuild-0.14.0 and possibly some other packages.  See this forum
> thread:
> 
> <https://forums.gentoo.org/viewtopic-t-1114522-highlight-ocaml.html>

I think this should be fixed now, or at least getting there.

[Comment 8 Larry the Git Cow 2021-06-08 04:59:19 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=34b06d35218d9e444050526511da10962ea72c2f

commit 34b06d35218d9e444050526511da10962ea72c2f
Author:     Sam James <[e-mail]>
AuthorDate: 2021-06-08 04:58:53 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2021-06-08 04:59:09 +0000

    dev-lang/ocaml: add CVE-2018-9838 patch to 4.05.0
    
    Closes: https://bugs.gentoo.org/755257
    Bug: https://bugs.gentoo.org/719134
    Signed-off-by: Sam James <[e-mail]>

 .../ocaml/files/ocaml-4.05.0-CVE-2018-9838.patch   |  70 ++++++++++
 dev-lang/ocaml/ocaml-4.05.0-r4.ebuild              | 143 +++++++++++++++++++++
 2 files changed, 213 insertions(+)

[addCollapseLink(9, 1, 'Toggle comment display'); Comment 9 NATTkA bot 2021-06-09 21:48:33 UTC Comment hidden (obsolete)]

Unable to check for sanity:

> no match for package: dev-lang/ocaml-4.09.0

[Comment 10 NATTkA bot 2021-06-18 21:12:39 UTC]

Unable to check for sanity:

> no match for package: dev-lang/ocaml-4.09.0-r1

[Comment 11 Hans de Graaff 2023-09-17 06:43:32 UTC]

ping.

Some cleanup is still needed (see PR) to fully resolve this bug.

[Comment 12 Larry the Git Cow 2023-10-28 00:24:49 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=da16ce0bc073186b149ff9cd6c6e8b724c88fd59

commit da16ce0bc073186b149ff9cd6c6e8b724c88fd59
Author:     John Helmert III <[e-mail]>
AuthorDate: 2023-10-22 23:00:32 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-10-28 00:24:09 +0000

    dev-lang/ocaml: drop 4.05.0-r9
    
    Bug: https://bugs.gentoo.org/719134
    Signed-off-by: John Helmert III <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/28090
    Signed-off-by: Sam James <[e-mail]>

 dev-lang/ocaml/Manifest               |   3 -
 dev-lang/ocaml/ocaml-4.05.0-r9.ebuild | 156 ----------------------------------
 2 files changed, 159 deletions(-)