Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 714948 - sys-boot/grub: Possible multiple vulnerabilities due to embedded gnulib (CVE-2017-7476, CVE-2018-17942)
Summary: sys-boot/grub: Possible multiple vulnerabilities due to embedded gnulib (CVE-...
Status: RESOLVED INVALID
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: CVE-2017-7476, CVE-2018-17942
  Show dependency tree
 
Reported: 2020-03-26 23:02 UTC by Sam James
Modified: 2020-03-27 05:56 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-03-26 23:02:06 UTC
It is suspected that this package is vulnerable to a security vulnerability in gnulib. As such we ask maintainers with packages suspected to be vulnerable to verify if the package is (or have been) affected. 

Please see the information contained in the tracker bug 714934:
*  CVE-2017-7476 - "Gnulib before 2017-04-26 has a heap-based buffer overflow with the TZ environment variable. The error is in the save_abbr function in time_rz.c."

** Patch: https://git.savannah.gnu.org/gitweb/?p=gnulib.git;a=commit;h=94e01571507835ff59dd8ce2a0b56a4b566965a4

* CVE-2018-17942 - "The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\0' character during %f processing."

** Patch: https://git.savannah.gnu.org/gitweb/?p=gnulib.git;a=commit;h=278b4175c9d7dd47c1a3071554aac02add3b3c35

If neither of these functions are used and haven't been in the past, you should be fine.

Please check if possible whether any embedded gnulib has now, or in the past (for GLSA purposes/cleanup if still in tree) contained in this version.
Comment 1 Mike Gilbert gentoo-dev 2020-03-27 02:46:27 UTC
I see no evidence that grub has ever used the save_abbr or convert_to_decimal functions.
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-03-27 05:56:53 UTC
(In reply to Mike Gilbert from comment #1)
> I see no evidence that grub has ever used the save_abbr or
> convert_to_decimal functions.

Agreed.