Bug 883947 (CVE-2014-4607) - VUL-0: CVE-2014-4607: lzo: DoS or possible RCE by allowing an attacker to change controllflow
Summary: VUL-0: CVE-2014-4607: lzo: DoS or possible RCE by allowing an attacker to cha...
Status: RESOLVED FIXED
Alias: CVE-2014-4607
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Deadline: 2014-07-24
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: maint:released:sles9-sp3-teradata:581...
Keywords:
Depends on:
Blocks:
 
Reported: 2014-06-24 08:02 UTC by Johannes Segitz
Modified: 2014-09-01 10:01 UTC (History)
2 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2014-06-24 08:02:54 UTC
CVE-2014-4607. Still embargoed and no CRD given, but this will probably change very soon since some reports leaked.

Report ID: LMS-2014-06-16-1
Report Code Name: LAZARUS.1
Researcher Name: Don A. Bailey

Vulnerability Scope:
liblzo1:
        - All versions of lzo1 are affected
liblzo2:
        - All versions of lzo2 are affected
        - Except for platforms that set both of the
          LZO_UNALIGNED_OK_8 and LZO_UNALIGNED_OK_4 preprocessor macros

Vulnerability Tested:
liblzo1:
        x86_64: vulnerable
        i386: vulnerable
        ARM: vulnerable
liblzo2:
        x86_64: not vulnerable
        i386: vulnerable
        ARM: vulnerable

Functions Affected:
        lzo1x_decompress_safe
        lzo1y_decompress_safe
        lzo1z_decompress_safe

Criticality Reasoning
---------------------
Despite the likelihood that this vulnerability will result in a simple denial
of service, there is a strong possibility that memory corruption can result
in remote code execution. If the LZO decompression algorithm is used in a
threaded or kernel context, it may be possible to corrupt memory structures
that control the flow of execution in other contexts. When the executive
switches context, control of a secondary thread or process may be obtained.
This attack is highly specialized and requires a deep understanding of the
target architecture to succeed. Therefore, it is possible, but impractical,
to implement a RCE attack using this bug.

Despite RCE being impractical, the criticality level must be defined as High
because the vulnerable algorithm has been in use since approximately 1999.
The set of affected systems is potentially large and unmanageable due to the
period of time the vulnerable algorithm has been deployed. As a result, there
may still be legacy systems in production that are vulnerable to RCE.

Vulnerability Description
-------------------------
An integer overflow may occur when processing any variant of a "literal run"
in the lzo1x_decompress_safe function. Each of these three locations is
subject to an integer overflow when processing zero bytes.

This exposes the code that copies literals to memory corruption.

It should be noted that if the target is 64bit liblzo2, the overflow is still
possible, but impractical. An overflow would require so much input data that
an attack would be infeasible even in modern computers.

Vulnerability Resolution
------------------------
A patch is in development.
Comment 1 Swamp Workflow Management 2014-06-24 12:56:54 UTC
An update workflow for this issue was started.
This issue was rated as important.
Please submit fixed packages until 2014-07-01.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/58008
Comment 2 SMASH SMASH 2014-06-24 13:00:20 UTC
Affected packages:

SLE-10-SP3-TERADATA: lzo
SLE-11-SP3: lzo
SLE-9-SP3-TERADATA: lzo
Comment 3 Swamp Workflow Management 2014-06-24 22:00:27 UTC
bugbot adjusting priority
Comment 7 Bernhard Wiedemann 2014-07-02 12:00:27 UTC
This is an autogenerated message for OBS integration:
This bug (883947) was mentioned in
https://build.opensuse.org/request/show/239295 Factory / lzo
https://build.opensuse.org/request/show/239298 13.1+12.3 / lzo
Comment 11 Swamp Workflow Management 2014-07-16 09:04:24 UTC
Update released for: liblzo2-2, lzo, lzo-debuginfo, lzo-debugsource, lzo-devel
Products:
SLE-DEBUGINFO 11-SP1-TERADATA (x86_64)
SLE-SERVER 11-SP1-TERADATA (x86_64)
Comment 12 Swamp Workflow Management 2014-07-16 09:04:45 UTC
Update released for: lzo, lzo-devel
Products:
SUSE-CORE 9-SP3-TERADATA (x86_64)
Comment 13 Swamp Workflow Management 2014-07-16 11:04:22 UTC
Update released for: lzo-devel
Products:
SLE-SERVER 10-SP3-TERADATA (x86_64)
Comment 14 Swamp Workflow Management 2014-07-16 13:51:02 UTC
Update released for: liblzo2-2, liblzo2-2-32bit, liblzo2-2-64bit, liblzo2-2-x86, lzo, lzo-debuginfo, lzo-debugsource, lzo-devel, lzo-devel-32bit, lzo-devel-64bit
Products:
SLE-DEBUGINFO 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP3 (i386, x86_64)
SLE-SDK 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP3 (i386, x86_64)
Comment 15 Swamp Workflow Management 2014-07-16 17:04:31 UTC
SUSE-SU-2014:0904-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 883947
CVE References: CVE-2014-4607
Sources used:
SUSE Linux Enterprise Software Development Kit 11 SP3 (src):    lzo-2.03-12.3.1
SUSE Linux Enterprise Server 11 SP3 for VMware (src):    lzo-2.03-12.3.1
SUSE Linux Enterprise Server 11 SP3 (src):    lzo-2.03-12.3.1
SUSE Linux Enterprise Desktop 11 SP3 (src):    lzo-2.03-12.3.1
Comment 17 Swamp Workflow Management 2014-07-17 15:51:00 UTC
An update workflow for this issue was started.
This issue was rated as important.
Please submit fixed packages until 2014-07-24.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/58336
Comment 18 Marcus Meissner 2014-07-17 15:55:50 UTC
we reviewed this and will schedule LTSS update for this, as this is likely
exploitable and as a library it is hard to say what services use it.

openvpn for instance uses lzo, although I have not checked in which scenarios.
Comment 19 Swamp Workflow Management 2014-07-21 08:04:49 UTC
openSUSE-SU-2014:0922-1: An update that contains security fixes can now be installed.

Category: security (moderate)
Bug References: 883947
CVE References: 
Sources used:
openSUSE 13.1 (src):    lzo-2.06-12.4.1
openSUSE 12.3 (src):    lzo-2.06-9.4.1
Comment 20 Swamp Workflow Management 2014-07-31 17:04:28 UTC
SUSE-SU-2014:0955-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 883947
CVE References: CVE-2014-4607
Sources used:
SUSE Linux Enterprise Server 11 SP2 LTSS (src):    lzo-2.03-12.3.1
SUSE Linux Enterprise Server 11 SP1 LTSS (src):    lzo-2.03-12.3.1
SUSE Linux Enterprise Server 10 SP4 LTSS (src):    lzo-2.02-12.10.1
SUSE Linux Enterprise Server 10 SP3 LTSS (src):    lzo-2.02-12.10.1
Comment 21 Marcus Meissner 2014-09-01 10:01:26 UTC
released