Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 907674 (CVE-2023-33551, CVE-2023-33552) - <sys-fs/erofs-utils-1.6-r1: multiple vulnerabilities
Summary: <sys-fs/erofs-utils-1.6-r1: multiple vulnerabilities
Status: IN_PROGRESS
Alias: CVE-2023-33551, CVE-2023-33552
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
URL:
Whiteboard: ~1 [noglsa cleanup]
Keywords:
Depends on:
Blocks:
 
Reported: 2023-06-02 04:12 UTC by John Helmert III
Modified: 2023-08-02 05:34 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-06-02 04:12:11 UTC 
CVE-2023-33551 (https://github.com/lometsj/blog_repo/issues/2):

Heap Buffer Overflow in the erofsfsck_dirent_iter function in fsck/main.c in erofs-utils v1.6 allows remote attackers to execute arbitrary code via a crafted erofs filesystem image.

CVE-2023-33552 (https://github.com/lometsj/blog_repo/issues/1):

Heap Buffer Overflow in the erofs_read_one_data function at data.c in erofs-utils v1.6 allows remote attackers to execute arbitrary code via a crafted erofs filesystem image.

No references to upstream.
Comment 2 Larry the Git Cow gentoo-dev 2023-07-15 17:51:44 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=65fec4463485c48cd2a2a2803b9adbd3afb43e10

commit 65fec4463485c48cd2a2a2803b9adbd3afb43e10
Author:     WANG Xuerui <xen0n@gentoo.org>
AuthorDate: 2023-07-15 17:50:16 +0000
Commit:     WANG Xuerui <xen0n@gentoo.org>
CommitDate: 2023-07-15 17:50:53 +0000

    sys-fs/erofs-utils: patch CVE-2023-33551 and CVE-2023-33552 for 1.6
    
    Bug: https://bugs.gentoo.org/907674
    Signed-off-by: WANG Xuerui <xen0n@gentoo.org>

 sys-fs/erofs-utils/erofs-utils-1.6-r1.ebuild       |  49 +++++++++
 .../files/erofs-utils-1.6-CVE-2023-33551.patch     |  70 ++++++++++++
 .../files/erofs-utils-1.6-CVE-2023-33552.patch     | 117 +++++++++++++++++++++
 3 files changed, 236 insertions(+)
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-08-02 05:34:43 UTC 
Thanks! Please cleanup when ready.