Bug 665656 – <net-libs/nodejs-{6.14.4,8.12.0}: out-of-bounds (OOB) write (CVE-2018-12115)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Mike Gilbert 2018-09-10 19:52:21 UTC]

From the security release blog:

Out of bounds (OOB) write (CVE-2018-12115)
All actively supported release lines of Node.js are impacted by this flaw.

Node.js TSC member Сковорода Никита Андреевич (Nikita Skovoroda / @ChALkeR) discovered an OOB write in Buffer that can be used to write to memory outside of a Buffer's memory space. This can corrupt unrelated Buffer objects or cause the Node.js process to crash.

When used with UCS-2 encoding (recognized by Node.js under the names 'ucs2', 'ucs-2', 'utf16le' and 'utf-16le'), Buffer#write() can be abused to write outside of the bounds of a single Buffer. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.

Impact:

All previous versions of Node.js 6.x (LTS "Boron") are vulnerable
All previous versions of Node.js 8.x (LTS "Carbon") are vulnerable
All previous versions of Node.js 10.x (Current) are vulnerable

[Comment 1 Mike Gilbert 2018-09-11 14:08:04 UTC]

Let go ahead and stabilize 6.14.4 and 8.11.4.

[Comment 2 Stabilization helper bot 2018-09-11 15:03:52 UTC]

An automated check of this bug failed - repoman reported dependency errors (626 lines truncated): 

> dependency.bad net-libs/nodejs/nodejs-6.14.4.ebuild: DEPEND: arm(default/linux/arm/13.0) ['>=net-libs/http-parser-2.7.0:=']
> dependency.bad net-libs/nodejs/nodejs-6.14.4.ebuild: RDEPEND: arm(default/linux/arm/13.0) ['>=net-libs/http-parser-2.7.0:=']
> dependency.bad net-libs/nodejs/nodejs-6.14.4.ebuild: DEPEND: arm(default/linux/arm/17.0) ['>=net-libs/http-parser-2.7.0:=']
> dependency.bad net-libs/nodejs/nodejs-6.14.4.ebuild: DEPEND: arm(default/linux/arm/13.0) ['>=net-libs/http-parser-2.7.0:=']
> dependency.bad net-libs/nodejs/nodejs-6.14.4.ebuild: RDEPEND: arm(default/linux/arm/13.0) ['>=net-libs/http-parser-2.7.0:=']
> dependency.bad net-libs/nodejs/nodejs-6.14.4.ebuild: DEPEND: arm(default/linux/arm/17.0) ['>=net-libs/http-parser-2.7.0:=']

[Comment 3 Stabilization helper bot 2018-09-11 16:02:30 UTC]

An automated check of this bug failed - repoman reported dependency errors (254 lines truncated): 

> dependency.bad net-libs/nodejs/nodejs-8.12.0.ebuild: DEPEND: amd64(default/linux/amd64/17.0) ['>=net-libs/nghttp2-1.32.0']
> dependency.bad net-libs/nodejs/nodejs-8.12.0.ebuild: RDEPEND: amd64(default/linux/amd64/17.0) ['>=net-libs/nghttp2-1.32.0']
> dependency.bad net-libs/nodejs/nodejs-8.12.0.ebuild: DEPEND: amd64(default/linux/amd64/17.0/desktop) ['>=net-libs/nghttp2-1.32.0']
> dependency.bad net-libs/nodejs/nodejs-8.12.0.ebuild: DEPEND: amd64(default/linux/amd64/17.0) ['>=net-libs/nghttp2-1.32.0']
> dependency.bad net-libs/nodejs/nodejs-8.12.0.ebuild: RDEPEND: amd64(default/linux/amd64/17.0) ['>=net-libs/nghttp2-1.32.0']
> dependency.bad net-libs/nodejs/nodejs-8.12.0.ebuild: DEPEND: amd64(default/linux/amd64/17.0/desktop) ['>=net-libs/nghttp2-1.32.0']

[Comment 4 Thomas Deutschmann (RETIRED) 2018-09-12 20:48:49 UTC]

x86 stable

[Comment 5 Agostino Sarubbo 2018-09-14 09:40:51 UTC]

amd64 stable

[Comment 6 Matt Turner 2018-09-17 18:34:01 UTC]

ppc/ppc64 stable. I dropped keywords on older versions of nodejs including version 6 since it fails tests and doesn't seem to be required for anything.

[Comment 7 Mikle Kolyada (RETIRED) 2018-11-17 15:28:31 UTC]

arm stable

[Comment 8 Sam James 2020-03-19 23:38:16 UTC]

Tree is clean.

[Comment 9 Yury German 2020-03-20 04:43:08 UTC]

Added to an existing GLSA Request.

[Comment 10 GLSAMaker/CVETool Bot 2020-03-20 19:21:47 UTC]

This issue was resolved and addressed in
 GLSA 202003-48 at https://security.gentoo.org/glsa/202003-48
by GLSA coordinator Thomas Deutschmann (whissi).

[Comment 11 Thomas Deutschmann (RETIRED) 2020-03-20 19:23:11 UTC]

Superseded by bug 708458.