Bug 647012 – <dev-libs/libtasn1-4.13: CVE-2018-6003: stack overflow due to unbounded recursion/DOS

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Ian Zimmerman 2018-02-08 16:35:26 UTC]

According to the RedHat bugzilla [1]:

It was found that indefinite string encoding is decoded via recursion in _asn1_decode_simple_ber() which can lead to stack exhaustion when processing specially crafted string.

Upstream fix [2]

[1]
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-6003

[2]
https://gitlab.com/gnutls/libtasn1/commit/c593ae84cfcde8fea45787e53950e0ac71e9ca97




Reproducible: Always

[Comment 1 Christopher Díaz Riveros (RETIRED) 2018-03-14 22:51:15 UTC]

 CVE ID: CVE-2018-6003
   Summary: An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.


@Maintainers 4.13 in tree, please call for stabilization when ready.

[Comment 2 Aaron Bauman (RETIRED) 2018-03-25 18:57:55 UTC]

@arches, please stabilize.

[Comment 3 Sergei Trofimovich (RETIRED) 2018-03-25 21:58:56 UTC]

ia64 stable

[Comment 4 Mikle Kolyada (RETIRED) 2018-03-26 19:49:24 UTC]

amd64 stable

[Comment 5 Mart Raudsepp 2018-03-28 19:47:51 UTC]

arm64 stable

[Comment 6 Thomas Deutschmann (RETIRED) 2018-03-29 14:54:34 UTC]

x86 stable

[Comment 7 Sergei Trofimovich (RETIRED) 2018-03-31 10:47:44 UTC]

ppc64 stable

[Comment 8 Tobias Klausmann (RETIRED) 2018-03-31 15:39:11 UTC]

Stable on alpha.

[Comment 9 Sergei Trofimovich (RETIRED) 2018-04-07 12:35:32 UTC]

ppc stable

[Comment 10 Markus Meier 2018-04-08 10:51:38 UTC]

arm stable

[Comment 11 Alon Bar-Lev (RETIRED) 2018-04-19 22:11:40 UTC]

@hppa?

[Comment 12 Matt Turner 2018-04-22 19:17:53 UTC]

hppa stable

[Comment 13 Aaron Bauman (RETIRED) 2018-04-22 21:00:28 UTC]

GLSA Vote: No

@maintainer(s), please clean the vulnerable versions.

[Comment 14 Larry the Git Cow 2018-04-22 21:15:27 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c77661f3bd26696bd9f99671369a67fb56a445c5

commit c77661f3bd26696bd9f99671369a67fb56a445c5
Author:     Alon Bar-Lev <[e-mail]>
AuthorDate: 2018-04-22 21:14:27 +0000
Commit:     Alon Bar-Lev <[e-mail]>
CommitDate: 2018-04-22 21:15:19 +0000

    dev-libs/libtasn1: cleanup
    
    Bug: https://bugs.gentoo.org/show_bug.cgi?id=647012
    Package-Manager: Portage-2.3.24, Repoman-2.3.6

 dev-libs/libtasn1/Manifest                         |  1 -
 .../files/libtasn1-4.12-CVE-2017-10790.patch       | 55 ----------------------
 dev-libs/libtasn1/libtasn1-4.12-r1.ebuild          | 50 --------------------
 3 files changed, 106 deletions(-)}

[Comment 15 Aaron Bauman (RETIRED) 2018-04-22 21:37:26 UTC]

(In reply to Larry the Git Cow from comment #14)
> The bug has been referenced in the following commit(s):
> 
> https://gitweb.gentoo.org/repo/gentoo.git/commit/
> ?id=c77661f3bd26696bd9f99671369a67fb56a445c5
> 
> commit c77661f3bd26696bd9f99671369a67fb56a445c5
> Author:     Alon Bar-Lev <[e-mail]>
> AuthorDate: 2018-04-22 21:14:27 +0000
> Commit:     Alon Bar-Lev <[e-mail]>
> CommitDate: 2018-04-22 21:15:19 +0000
> 
>     dev-libs/libtasn1: cleanup
>     
>     Bug: https://bugs.gentoo.org/show_bug.cgi?id=647012
>     Package-Manager: Portage-2.3.24, Repoman-2.3.6
> 
>  dev-libs/libtasn1/Manifest                         |  1 -
>  .../files/libtasn1-4.12-CVE-2017-10790.patch       | 55
> ----------------------
>  dev-libs/libtasn1/libtasn1-4.12-r1.ebuild          | 50 --------------------
>  3 files changed, 106 deletions(-)}

Thanks, Alon!