Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 774471 (CVE-2021-3420) - <sys-libs/newlib-4.0.0: heap buffer overflow vulnerability (CVE-2021-3420)
Summary: <sys-libs/newlib-4.0.0: heap buffer overflow vulnerability (CVE-2021-3420)
Status: RESOLVED FIXED
Alias: CVE-2021-3420
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial
Assignee: Gentoo Security
URL:
Whiteboard: ~4 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2021-03-06 15:34 UTC by John Helmert III
Modified: 2021-03-07 15:20 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-03-06 15:34:03 UTC 
CVE-2021-3420:

A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions mEMALIGn, pvALLOc, nano_memalign, nano_valloc, nano_pvalloc could case an integer overflow, leading to an allocation of a small buffer and then to a heap-based buffer overflow.

Patch: https://sourceware.org/git/?p=newlib-cygwin.git;a=commit;h=aa106b29a6a8a1b0df9e334704292cbc32f2d44e


Please cleanup.
Comment 1 Larry the Git Cow gentoo-dev 2021-03-06 19:31:11 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5c22741a8324665e9caafb2b9342f9908945760a

commit 5c22741a8324665e9caafb2b9342f9908945760a
Author:     Sergei Trofimovich <slyfox@gentoo.org>
AuthorDate: 2021-03-06 19:30:37 +0000
Commit:     Sergei Trofimovich <slyfox@gentoo.org>
CommitDate: 2021-03-06 19:31:07 +0000

    sys-libs/newlib: drop old
    
    Bug: https://bugs.gentoo.org/774471
    Package-Manager: Portage-3.0.16, Repoman-3.0.2
    Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>

 sys-libs/newlib/Manifest               |   2 -
 sys-libs/newlib/newlib-3.3.0-r1.ebuild | 154 ---------------------------------
 sys-libs/newlib/newlib-3.3.0.ebuild    | 150 --------------------------------
 sys-libs/newlib/newlib-4.0.0.ebuild    | 154 ---------------------------------
 4 files changed, 460 deletions(-)
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-03-07 15:20:34 UTC 
Thank you! All done.