Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 823804 (CVE-2021-43618) - <dev-libs/gmp-6.2.1-r2: Buffer overflow (CVE-2021-43618)
Summary: <dev-libs/gmp-6.2.1-r2: Buffer overflow (CVE-2021-43618)
Status: IN_PROGRESS
Alias: CVE-2021-43618
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://bugs.debian.org/994405
Whiteboard: A3 [glsa? cleanup]
Keywords:
Depends on: 829387
Blocks:
  Show dependency tree
 
Reported: 2021-11-15 08:09 UTC by Sam James
Modified: 2021-12-22 06:15 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-11-15 08:09:11 UTC
Description:
"GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms."
Comment 1 Larry the Git Cow gentoo-dev 2021-11-25 02:45:31 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0c55fe4bf46a1b867746a6ead419fce585d0d456

commit 0c55fe4bf46a1b867746a6ead419fce585d0d456
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2021-11-25 02:41:44 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-11-25 02:45:24 +0000

    dev-libs/gmp: add patch for CVE-2021-43618; add Darwin arm64 patch
    
    Apply two upstream patches:
    - Fix CVE-2021-43618
    - Fix incorrect use of reserved register on Darwin/arm64
    
    Bug: https://bugs.gentoo.org/823804
    Signed-off-by: Sam James <sam@gentoo.org>

 dev-libs/gmp/Manifest                             |   1 +
 dev-libs/gmp/files/gmp-6.2.1-CVE-2021-43618.patch |  17 ++++
 dev-libs/gmp/gmp-6.2.1-r2.ebuild                  | 116 ++++++++++++++++++++++
 3 files changed, 134 insertions(+)
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-12-22 06:15:52 UTC
Please cleanup