Bugzilla – Bug 798538
VUL-1: CVE-2013-0221: coreutils: segmentation fault in "sort -d" and "sort -M" with long line input
Last modified: 2016-02-19 00:28:57 UTC
+++ This bug was initially created as a clone of Bug #796243 +++ User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20100101 Firefox/17.0 "sort -d" and "sort -M" crashe if input stream contains very long strings % perl -e 'print "1","A"x50000000,"\r\n\r\n"' | sort -d [1] 13431 done perl -e 'print "1","A"x50000000,"\r\n\r\n"' | 13432 segmentation fault sort -d % perl -e 'print "1","A"x50000000,"\r\n\r\n"' | sort -M [1] 13433 done perl -e 'print "1","A"x50000000,"\r\n\r\n"' | 13434 segmentation fault sort -M Depending on the stack size the sequence can be as short as ~10MB (in the above example 50MB) Reproducible: Always Steps to Reproduce: 1. see above Actual Results: crash Expected Results: no crash
Bug also present in 12.1. Bug cannot be reproduced with upstream coreutils' sort, and therefore is most probably in SuSE's patches.
Yes, I believe it is in SUSE coreutils-i18n.patch. I mentioned it in the related bug https://bugzilla.novell.com/show_bug.cgi?id=796243
Probably enough to fix it in Factory.
I disagree strongly. Given that join, sort and uniq can be failed I'd rate this severe enough to warrant a complete update for both SLES and openSUSE. Im working on a patch that fixes all three secbugs.
Fixed in Base:System, submitted to Factory: https://build.opensuse.org/request/show/149348 Fixes for openSUSE:Maintenance pending.
@philipp: I agree
Please wait with the opensuse submits until we've got a CVE.
´
CVE-2013-0221 was assigned to this.
Maintenance requests created: 11.4: https://build.opensuse.org/request/show/149689 12.1: https://build.opensuse.org/request/show/149691 12.2: https://build.opensuse.org/request/show/149694
This is an autogenerated message for OBS integration: This bug (798538) was mentioned in https://build.opensuse.org/request/show/150013 Maintenance /
This is an autogenerated message for OBS integration: This bug (798538) was mentioned in https://build.opensuse.org/request/show/150015 Maintenance /
This is an autogenerated message for OBS integration: This bug (798538) was mentioned in https://build.opensuse.org/request/show/150025 Maintenance /
openSUSE-SU-2013:0232-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 796243,798538,798541 CVE References: CVE-2013-0221,CVE-2013-0222,CVE-2013-0223 Sources used: openSUSE 12.1 (src): coreutils-8.14-3.19.1
openSUSE-SU-2013:0233-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 796243,798538,798541 CVE References: CVE-2013-0221,CVE-2013-0222,CVE-2013-0223 Sources used: openSUSE 12.2 (src): coreutils-8.16-5.12.1
openSUSE-SU-2013:0237-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 796243,798538,798541 CVE References: CVE-2013-0221,CVE-2013-0222,CVE-2013-0223 Sources used: openSUSE 11.4 (src): coreutils-8.9-23.1
Please submit with the current coreutils update for SLE11
AFAICS complete and building packages submitted via SRs 28341 and 28342
The SWAMPID for this issue is 54064. This issue was rated as moderate. Please submit fixed packages until 2013-08-28. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
Packages for SLE where submitted.
Reopening to reassign
Update released for: coreutils, coreutils-debuginfo, coreutils-debuginfo-x86, coreutils-debugsource, coreutils-lang, coreutils-x86 Products: SLE-DEBUGINFO 11-SP2 (i386, ia64, ppc64, s390x, x86_64) SLE-DESKTOP 11-SP2 (i386, x86_64) SLE-SERVER 11-SP2 (i386, ia64, ppc64, s390x, x86_64) SLES4VMWARE 11-SP2 (i386, x86_64)
Update released for: coreutils, coreutils-debuginfo, coreutils-debuginfo-x86, coreutils-debugsource, coreutils-lang, coreutils-x86 Products: SLE-DEBUGINFO 11-SP3 (i386, ia64, ppc64, s390x, x86_64) SLE-DESKTOP 11-SP3 (i386, x86_64) SLE-SERVER 11-SP3 (i386, ia64, ppc64, s390x, x86_64) SLES4VMWARE 11-SP3 (i386, x86_64)
Update released for: coreutils, coreutils-debuginfo, coreutils-debugsource, coreutils-lang Products: SLE-SERVER 11-SP1-TERADATA (x86_64)
released
Fixed with sr 83566
An update workflow for this issue was started. This issue was rated as "moderate". Please submit fixed packages until "Dec. 16, 2015". When done, reassign the bug to "security-team@suse.de". /update/62363/.
An update workflow for this issue was started. This issue was rated as moderate. Please submit fixed packages until 2015-12-16. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/62363