Bug 796243 (CVE-2013-0222) - VUL-1: CVE-2013-0222: coreutils: segmentation fault in "uniq" with long line input
Summary: VUL-1: CVE-2013-0222: coreutils: segmentation fault in "uniq" with long line ...
Status: RESOLVED FIXED
Alias: CVE-2013-0222
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: x86-64 openSUSE 12.2
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2013-08-28
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: maint:released:sle11-sp3:54067 maint...
Keywords:
Depends on:
Blocks: CVE-2013-0221 CVE-2013-0223
  Show dependency treegraph
 
Reported: 2012-12-31 17:57 UTC by Forgotten User m4H6SeH0_b
Modified: 2015-12-04 12:11 UTC (History)
5 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Forgotten User m4H6SeH0_b 2012-12-31 17:57:43 UTC
User-Agent:       Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20100101 Firefox/17.0

"uniq" crashes if input stream contains very large sequence of NULL bytes

% perl -e 'print "1","\0"x50000000,"\r\n\r\n"' | uniq
[2]    8244 done                perl -e 'print "1","\0"x50000000,"\r\n\r\n"' | 
       8245 segmentation fault  uniq

Depending on the stack size the NULL-character sequence can be as short as ~10MB (in the above example 50MB)

Reproducible: Always

Steps to Reproduce:
1. perl -e 'print "1","\0"x50000000,"\r\n\r\n"' | uniq
Actual Results:  
crash

Expected Results:  
no crash

The upstream version of coreutils does not have this problem (doesn't crash). The bug seems to be in the openSUSE specific multi-byte character patch (coreutils-i18n.patch).

The crash happens in "different_multi" function due to call to "alloca" returning pointer beyond the stack.
Comment 1 Sebastian Krahmer 2013-01-16 13:26:47 UTC
Can reproduce it for 12.2
Comment 2 Bernhard Voelker 2013-01-16 13:27:36 UTC
'man alloca':
  If the allocation causes stack overflow, program behavior is undefined.

Replacing the use of alloca() by xmalloc() + free() works.
I'm working on a patch.
Comment 3 Philipp Thomas 2013-01-16 14:44:52 UTC
I'm already working on a patch for all three bugs. For speed reasons my patch uses xmalloc for anything beyond 4k.
Comment 4 Bernhard Voelker 2013-01-21 08:37:45 UTC
Fixed in Base:System, submitted to Factory:
https://build.opensuse.org/request/show/149348

Fixes for openSUSE:Maintenance pending.
Comment 5 Matthias Weckbecker 2013-01-23 11:58:21 UTC
CVE-2013-0222 was assigned to this.
Comment 7 Bernhard Wiedemann 2013-01-26 19:00:08 UTC
This is an autogenerated message for OBS integration:
This bug (796243) was mentioned in
https://build.opensuse.org/request/show/150013 Maintenance /
Comment 8 Bernhard Wiedemann 2013-01-26 20:00:18 UTC
This is an autogenerated message for OBS integration:
This bug (796243) was mentioned in
https://build.opensuse.org/request/show/150015 Maintenance /
Comment 9 Bernhard Wiedemann 2013-01-26 21:00:10 UTC
This is an autogenerated message for OBS integration:
This bug (796243) was mentioned in
https://build.opensuse.org/request/show/150025 Maintenance /
Comment 10 Swamp Workflow Management 2013-02-04 13:04:45 UTC
openSUSE-SU-2013:0232-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 796243,798538,798541
CVE References: CVE-2013-0221,CVE-2013-0222,CVE-2013-0223
Sources used:
openSUSE 12.1 (src):    coreutils-8.14-3.19.1
Comment 11 Swamp Workflow Management 2013-02-04 13:05:18 UTC
openSUSE-SU-2013:0233-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 796243,798538,798541
CVE References: CVE-2013-0221,CVE-2013-0222,CVE-2013-0223
Sources used:
openSUSE 12.2 (src):    coreutils-8.16-5.12.1
Comment 12 Swamp Workflow Management 2013-02-04 14:04:32 UTC
openSUSE-SU-2013:0237-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 796243,798538,798541
CVE References: CVE-2013-0221,CVE-2013-0222,CVE-2013-0223
Sources used:
openSUSE 11.4 (src):    coreutils-8.9-23.1
Comment 13 Marcus Meissner 2013-03-19 13:27:03 UTC
Please submit with the current coreutils update for SLE11
Comment 14 Philipp Thomas 2013-06-04 03:58:00 UTC
Everything submitted
Comment 15 Marcus Meissner 2013-06-04 05:51:55 UTC
I do not see any submission.

request ids?

also reassign the bugs back to security-team when done.
Comment 16 Philipp Thomas 2013-06-05 09:38:07 UTC
I'm checking the submissions right now. Would it be OK to include later bugfixes that were pending acceptance?
Comment 17 Marcus Meissner 2013-06-06 06:27:49 UTC
yes please
Comment 19 Swamp Workflow Management 2013-08-14 06:21:00 UTC
The SWAMPID for this issue is 54064.
This issue was rated as moderate.
Please submit fixed packages until 2013-08-28.
When done, please reassign the bug to security-team@suse.de.
Patchinfo will be handled by security team.
Comment 20 Philipp Thomas 2013-08-19 13:12:54 UTC
Packages for SLE have been released
Comment 21 Philipp Thomas 2013-08-19 13:39:21 UTC
Reopen to reassign.
Comment 22 Swamp Workflow Management 2013-09-25 14:49:51 UTC
Update released for: coreutils, coreutils-debuginfo, coreutils-debuginfo-x86, coreutils-debugsource, coreutils-lang, coreutils-x86
Products:
SLE-DEBUGINFO 11-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP2 (i386, x86_64)
SLE-SERVER 11-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP2 (i386, x86_64)
Comment 23 Swamp Workflow Management 2013-09-25 14:55:34 UTC
Update released for: coreutils, coreutils-debuginfo, coreutils-debuginfo-x86, coreutils-debugsource, coreutils-lang, coreutils-x86
Products:
SLE-DEBUGINFO 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP3 (i386, x86_64)
SLE-SERVER 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP3 (i386, x86_64)
Comment 24 Swamp Workflow Management 2013-09-26 09:04:49 UTC
Update released for: coreutils, coreutils-debuginfo, coreutils-debugsource, coreutils-lang
Products:
SLE-SERVER 11-SP1-TERADATA (x86_64)
Comment 25 Marcus Meissner 2013-10-01 15:07:59 UTC
rekleased