Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 625392 (CVE-2017-11343) - <dev-scheme/chicken-4.13.0-r1: algorithmic complexity attack in hash tables
Summary: <dev-scheme/chicken-4.13.0-r1: algorithmic complexity attack in hash tables
Status: RESOLVED FIXED
Alias: CVE-2017-11343
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard: B3 [noglsa cve]
Keywords:
Depends on:
Blocks: CVE-2016-6830, CVE-2016-6831 CVE-2017-6949 CVE-2017-9334
  Show dependency tree
 
Reported: 2017-07-17 07:55 UTC by Agostino Sarubbo
Modified: 2018-06-11 15:08 UTC (History)
4 users (show)

See Also:
Package list:
dev-scheme/chicken-4.13.0-r1 alpha amd64 ppc ppc64 x86
Runtime testing required: ---
stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2017-07-17 07:55:19 UTC 
From ${URL} :

I just received the CVE-2017-11343 assignment for an issue in
CHICKEN Scheme.  An attacker is able to cause O(n) lookup for
hash tables by predicting the buckets in which interned symbols
will end up, due to a partially incorrect fix for CVE-2012-6125
where the randomization factor was determined before initializing
the PRNG with a seed state.

This issue affects only the Scheme symbol table, not user-created
hash tables.  All CHICKEN releases up to and including 4.12.0 are
affected.

More info:
http://lists.nongnu.org/archive/html/chicken-announce/2017-07/msg00000.html



@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Maxim Koltsov (RETIRED) gentoo-dev 2018-03-15 21:07:32 UTC 
I've added chicken-4.13, which fixed all CVEs:

https://code.call-cc.org/releases/4.13.0/NEWS

I've enabled test suite and all tests pass, so I think it's safe to stabilize chicken-4.13.0.
Comment 2 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2018-03-15 21:23:38 UTC 
amd64 stable
Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev 2018-03-18 00:43:31 UTC 
x86 stable
Comment 4 Sergei Trofimovich (RETIRED) gentoo-dev 2018-03-18 10:33:17 UTC 
~ppc/~ppc64 stable
Comment 5 Tobias Klausmann (RETIRED) gentoo-dev 2018-03-31 10:11:45 UTC 
Stable on alpha.
Comment 6 Aaron Bauman (RETIRED) gentoo-dev 2018-06-11 15:08:09 UTC 
tree is clean.

GLSA Vote: No