Bug 907456 (CVE-2014-9112) - VUL-0: CVE-2014-9112: cpio: heap-based buffer overflow flaw in list_file()
Summary: VUL-0: CVE-2014-9112: cpio: heap-based buffer overflow flaw in list_file()
Status: RESOLVED FIXED
Alias: CVE-2014-9112
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2014-12-12
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/111070/
Whiteboard: maint:released:sle11-sp1:59939 maint...
Keywords:
Depends on:
Blocks:
 
Reported: 2014-11-27 09:45 UTC by Victor Pereira
Modified: 2016-02-17 21:18 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2014-11-27 09:45:21 UTC
CVE-2014-9112

A heap-based buffer overflow flaw was reported in cpio's list_file() function. Attempting to extract a malicious cpio archive could cause cpio to crash or, potentially, execute arbitrary code.

As noted in the original report, this issue could be trigger via other utilities, such as when running "less".


References:
https://bugzilla.redhat.com/show_bug.cgi?id=1167571
Comment 1 Swamp Workflow Management 2014-11-27 23:00:34 UTC
bugbot adjusting priority
Comment 2 Swamp Workflow Management 2014-11-28 12:30:41 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2014-12-12.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/59828
Comment 3 Vítězslav Čížek 2014-12-01 17:51:08 UTC
Packages submitted. Reassigning to security-team.
Comment 5 Bernhard Wiedemann 2014-12-01 18:00:30 UTC
This is an autogenerated message for OBS integration:
This bug (907456) was mentioned in
https://build.opensuse.org/request/show/263649 13.2+13.1+12.3 / cpio
Comment 9 Swamp Workflow Management 2014-12-15 12:08:14 UTC
openSUSE-SU-2014:1643-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 907456
CVE References: CVE-2014-9112
Sources used:
openSUSE 13.2 (src):    cpio-2.11-29.5.1
openSUSE 13.1 (src):    cpio-2.11-25.4.1
openSUSE 12.3 (src):    cpio-2.11-21.4.1
Comment 10 Swamp Workflow Management 2014-12-17 09:05:10 UTC
SUSE-SU-2014:1652-1: An update that solves one vulnerability and has one errata is now available.

Category: security (moderate)
Bug References: 658010,907456
CVE References: CVE-2014-9112
Sources used:
SUSE Linux Enterprise Server 12 (src):    cpio-2.11-29.1
SUSE Linux Enterprise Desktop 12 (src):    cpio-2.11-29.1
Comment 11 jun wang 2014-12-17 10:12:06 UTC
after update, ran the testcase and got the info:

"""
## ------------------------ ##
## GNU cpio 2.9 test suite. ##
## ------------------------ ##
  1: cpio version                                    ok
  2: basic functionality: copyin/copyout             ok
  3: symlink                                         ok
  4: symlink-bad-length                              FAILED (symlink-bad-length.at:38)
  5: symlink-long                                    ok
  6: interdir                                        FAILED (interdir.at:31)
"""

Is the issue was not fixed ?
please check and verify it.
Comment 12 Vítězslav Čížek 2014-12-17 14:50:06 UTC
It is FIXED.

The symlink-bad-length test is supposed to die on this "if":

off_t n = file_hdr->c_filesize + 1;

if (n == 0 || n > SIZE_MAX) {
  error (0, 0, _("%s: stored filename length too big"), file_hdr->c_name);
} else {
  link_name = xmalloc (n);
  [...]

However, the test is meant for 32bit systems where SIZE_MAX is 4294967295 (2^32 - 1)
The supplied filesize is 2^32 - 1, so n is 4294967296 (2^32).

On 64bit systems the SIZE_MAX is 2^64 - 1, thus the condition isn't fulfilled,
(4294967296 isn't bigger than 18446744073709551615)

The execution takes the else-branch and tries to allocate the ridiculous amount of memory and fails with "memory exhausted"

The interdir test apparently fails with or without the latest security patch.
Comment 13 jun wang 2014-12-18 02:30:37 UTC
(In reply to Vitezslav Cizek from comment #12)
> It is FIXED.
> 
> The symlink-bad-length test is supposed to die on this "if":
> 
> off_t n = file_hdr->c_filesize + 1;
> 
> if (n == 0 || n > SIZE_MAX) {
>   error (0, 0, _("%s: stored filename length too big"), file_hdr->c_name);
> } else {
>   link_name = xmalloc (n);
>   [...]
> 
> However, the test is meant for 32bit systems where SIZE_MAX is 4294967295
> (2^32 - 1)
> The supplied filesize is 2^32 - 1, so n is 4294967296 (2^32).
> 
> On 64bit systems the SIZE_MAX is 2^64 - 1, thus the condition isn't
> fulfilled,
> (4294967296 isn't bigger than 18446744073709551615)
> 
> The execution takes the else-branch and tries to allocate the ridiculous
> amount of memory and fails with "memory exhausted"
> 
> The interdir test apparently fails with or without the latest security patch.

I see, thank you.
Comment 14 Swamp Workflow Management 2014-12-20 04:04:58 UTC
SUSE-SU-2014:1675-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 907456
CVE References: CVE-2014-9112
Sources used:
SUSE Linux Enterprise Server 11 SP3 for VMware (src):    cpio-2.9-75.78.1
SUSE Linux Enterprise Server 11 SP3 (src):    cpio-2.9-75.78.1
SUSE Linux Enterprise Desktop 11 SP3 (src):    cpio-2.9-75.78.1
Comment 15 Victor Pereira 2014-12-23 09:13:01 UTC
released