Bugzilla – Bug 1103878
VUL-0: CVE-2018-1000637: zutils: buffer overflow in zutils zcat
Last modified: 2019-08-14 14:43:02 UTC
via oss-sec From: Ben Hutchings <ben@decadent.org.uk> Subject: [oss-security] Heap-based buffer overflow in zutils zcat A heap-based buffer overflow (CWE-122) was discovered in the zutils implementation of zcat. It is apparently possible only if the -v option, or one of the other options that implies -v, is used. This seems to have been first discovered in 2016 as a result of interaction between initramfs-tools and zutils, but was initially thought to be a bug in the gzip implementation of zcat: https://bugs.launchpad.net/ubuntu/+source/intel-microcode/+bug/1507443 https://bugs.debian.org/815915 It was eventually reported to the zutils upstream developer (Antonio Diaz Diaz, cc'd) in the last few weeks and was fixed in version 1.8-pre2. This was announced in: https://lists.nongnu.org/archive/html/zutils-bug/2018-08/msg00000.html I will request a CVE ID for this. Ben.
Fix submitted.
can you also submit fixes for 42.3 and 15.0?
Done.
This is an autogenerated message for OBS integration: This bug (1103878) was mentioned in https://build.opensuse.org/request/show/630790 15.0+42.3 / zutils https://build.opensuse.org/request/show/630793 15.0+42.3 / zutils
Regarding the "zutils implementation of zcat": I wonder if anyone can even use it? Installing it removes zypper, dracut, lvm, mdadm and all of YaST. Problem: zutils-1.6-lp150.1.2.x86_64 conflicts with gzip provided by gzip-1.9-lp150.2.16.x86_64 Solution 1: Following actions will be done: deinstallation of gzip-1.9-lp150.2.16.x86_64 [...] deinstallation of dracut-044.1-lp150.13.6.x86_64 [...] deinstallation of zypper-1.14.5-lp150.1.1.x86_64 [...] deinstallation of lvm2-2.02.177-lp150.5.1.x86_64 [...] deinstallation of yast2-4.0.79-lp150.2.6.1.x86_64 [...] deinstallation of mdadm-4.0-lp150.7.1.x86_64 So this is pretty much not testable as a maintenance update. Regarding the package content: These binaries are also provided by gzip: /usr/bin/zcat /usr/bin/zcmp /usr/bin/zdiff /usr/bin/zegrep /usr/bin/zfgrep /usr/bin/zgrep These are unique to zlib: /usr/bin/ztest /usr/bin/zupdate For Factory, is this not a case for update-alternatives? The package is a leaf in Factory for building, and no package appears to require it on Leap 15.0 Finally: (In reply to Swamp Workflow Management from comment #4) > This is an autogenerated message for OBS integration: > https://build.opensuse.org/request/show/630793 15.0+42.3 / zutils This contains more than the security fix. Is that required and if so what is the rationale? Just collect all upstream fixes?
(In reply to Andreas Stieger from comment #5) > Regarding the "zutils implementation of zcat": > I wonder if anyone can even use it? Installing it removes zypper, dracut, > lvm, mdadm and all of YaST. > > Problem: zutils-1.6-lp150.1.2.x86_64 conflicts with gzip provided by > gzip-1.9-lp150.2.16.x86_64 > Solution 1: Following actions will be done: > deinstallation of gzip-1.9-lp150.2.16.x86_64 > [...] > deinstallation of dracut-044.1-lp150.13.6.x86_64 > [...] > deinstallation of zypper-1.14.5-lp150.1.1.x86_64 > [...] > deinstallation of lvm2-2.02.177-lp150.5.1.x86_64 > [...] > deinstallation of yast2-4.0.79-lp150.2.6.1.x86_64 > [...] > deinstallation of mdadm-4.0-lp150.7.1.x86_64 > > So this is pretty much not testable as a maintenance update. > > Regarding the package content: > > These binaries are also provided by gzip: > /usr/bin/zcat > /usr/bin/zcmp > /usr/bin/zdiff > /usr/bin/zegrep > /usr/bin/zfgrep > /usr/bin/zgrep > > These are unique to zlib: > /usr/bin/ztest > /usr/bin/zupdate > > For Factory, is this not a case for update-alternatives? > > The package is a leaf in Factory for building, and no package appears to > require it on Leap 15.0 First time I hear about this. Wasn't some automated test supposed to detect collisions? > Finally: > (In reply to Swamp Workflow Management from comment #4) > > This is an autogenerated message for OBS integration: > > https://build.opensuse.org/request/show/630793 15.0+42.3 / zutils > > This contains more than the security fix. Is that required and if so what is > the rationale? Just collect all upstream fixes? The patch doesn't apply to 1.4 on 42.3 and being a security matter I wasn't confident in modifying it. So, 42.3 would have ended up with 1.7 and 15.0 with 1.6. It didn't seem proper. What's the praxis in a case like this?
(In reply to Luigi Baldoni from comment #6) > First time I hear about this. Wasn't some automated test supposed to detect > collisions? The file conflicts were found and correctly expressed as package conflicts. Beyond that, no OpenQA scenario seems to be using zutils. Of course the Maintenance OpenQA test try to install all updated packages, and would fail for this submitted update because the package was never really usable, in the sense that it conflicts with gzip and gzip is used by everything - explicitly. So this is a shared packaging bug between gzip and zutils, e.g. not being able to replace one another, and the whole distribution referencing gzip by explicit name. We can do the update nevertheless, just the OpenQA test will fail due to the above and we would need to override. > The patch doesn't apply to 1.4 on 42.3 and being a security matter I wasn't > confident in modifying it. So, 42.3 would have ended up with 1.7 and 15.0 > with 1.6. It didn't seem proper. > > What's the praxis in a case like this? We usually try backports first, then if the backport is not feasible or desirable do conservative version updates. Yes we would do it to the same version, for reasons you pointed out. This being a CLI it would actually work as there are no other dependencies. So thanks for the clarification. I believe we can go ahead. If you want you can consider cases of parallel installation (update-alternatives) for Factory.
openSUSE-SU-2018:2591-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1103878 CVE References: CVE-2018-1000637 Sources used: openSUSE Leap 42.3 (src): zutils-1.7-4.3.1 openSUSE Leap 15.0 (src): zutils-1.7-lp150.2.3.1
released