Bug 791952 – <app-arch/lz4-1.9.3-r1: Memory corruption due to an integer overflow (CVE-2021-3520)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Teika kazura 2021-05-25 11:35:45 UTC]

CVE-2021-3520 was issued. The bug is:
"memory corruption due to an integer overflow bug caused by memmove argument"

Upstream fixed it in a commit[1] but not yet bumped the version.
[1]: https://github.com/lz4/lz4/commit/8301a21773ef61656225e264f4f06ae14462bca7

For the details, please refer to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=987856 (Sorry, I lack adequate training to report a security bug.)

Thanks beforehand. Regards.

[Comment 1 Sam James 2021-05-25 11:43:24 UTC]

Thanks for the report!

Maintainers, please apply the patch if suitable.

[Comment 2 Sam James 2021-06-02 18:56:37 UTC]

https://bugzilla.redhat.com/show_bug.cgi?id=1954559:
"The lz4 binary itself catches the problem when it parses the header, but it seems not all library consumers do and therefore LZ4_decompress_generic() was patched."

[Comment 3 Sam James 2021-06-08 06:20:41 UTC]

ping

[Comment 4 Michał Górny 2021-06-08 11:35:08 UTC]

The patch is trivial enough, so I'll just push it straight to stable.

[Comment 5 Larry the Git Cow 2021-06-08 11:42:17 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f063d9e1dcac596d0a15fab50c8d89c4d8a9d0e3

commit f063d9e1dcac596d0a15fab50c8d89c4d8a9d0e3
Author:     Michał Górny <[e-mail]>
AuthorDate: 2021-06-08 11:34:45 +0000
Commit:     Michał Górny <[e-mail]>
CommitDate: 2021-06-08 11:42:14 +0000

    app-arch/lz4: Backport memory corruption fix (CVE-2021-3520)
    
    Bug: https://bugs.gentoo.org/791952
    Signed-off-by: Michał Górny <[e-mail]>

 .../lz4/files/lz4-1.9.3-negative-memmove.patch     | 22 ++++++++++++++++++++++
 .../lz4/{lz4-1.9.3.ebuild => lz4-1.9.3-r1.ebuild}  |  4 ++++
 2 files changed, 26 insertions(+)

[Comment 6 John Helmert III 2021-06-09 04:10:52 UTC]

Thank you!

[addCollapseLink(7, 1, 'Toggle comment display'); Comment 7 NATTkA bot 2021-07-29 17:22:18 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(8, 1, 'Toggle comment display'); Comment 8 NATTkA bot 2021-07-29 17:30:32 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(9, 1, 'Toggle comment display'); Comment 9 NATTkA bot 2021-07-29 17:38:29 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(10, 1, 'Toggle comment display'); Comment 10 NATTkA bot 2021-07-29 17:46:36 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(11, 1, 'Toggle comment display'); Comment 11 NATTkA bot 2021-07-29 18:02:35 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[Comment 12 NATTkA bot 2021-07-29 18:10:51 UTC]

Package list is empty or all packages have requested keywords.

[Comment 13 Allen Webb 2023-05-11 18:05:03 UTC]

1.9.4 has the fix:

See:
https://github.com/lz4/lz4/blob/v1.9.4/lib/lz4.c#L1950

[Comment 14 Sam James 2023-05-12 01:14:37 UTC]

(In reply to Allen Webb from comment #13)
> 1.9.4 has the fix:
> 
> See:
> https://github.com/lz4/lz4/blob/v1.9.4/lib/lz4.c#L1950

We backported it in 1.9.3-r1.

[Comment 15 Larry the Git Cow 2024-06-22 08:03:10 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=acb9476bc172258fe693650384438c25dcfc468d

commit acb9476bc172258fe693650384438c25dcfc468d
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2024-06-22 08:02:03 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2024-06-22 08:02:32 +0000

    [ GLSA 202406-04 ] LZ4: Memory Corruption
    
    Bug: https://bugs.gentoo.org/791952
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202406-04.xml | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

[Comment 16 Sam James 2024-12-14 11:44:35 UTC]

*** Bug 946399 has been marked as a duplicate of this bug. ***