Bug 1115797 (CVE-2018-19209) - VUL-1: CVE-2018-19209: nasm: NULL pointer dereference in the function find_label in asm/labels.c that will lead to a DoS attack
Summary: VUL-1: CVE-2018-19209: nasm: NULL pointer dereference in the function find_la...
Status: RESOLVED INVALID
Alias: CVE-2018-19209
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Minor
Target Milestone: ---
Assignee: Adam Majer
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/219074/
Whiteboard: CVSSv3:SUSE:CVE-2018-19209:3.3:(AV:L...
Keywords:
Depends on:
Blocks:
 
Reported: 2018-11-13 14:27 UTC by Robert Frohl
Modified: 2018-11-13 15:50 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
QA Reproducer (633 bytes, application/vnd.rar)
2018-11-13 15:38 UTC, Robert Frohl 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2018-11-13 14:27:28 UTC 
CVE-2018-19209

Netwide Assembler (NASM) 2.14rc15 has a NULL pointer dereference in the function
find_label in asm/labels.c that will lead to a DoS attack.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-19209
https://bugzilla.nasm.us/show_bug.cgi?id=3392522
Comment 1 Robert Frohl 2018-11-13 15:21:09 UTC 
Reproducer does not work for me, no useful backtrace in upstream ticket to identify patch and no direct pointer to a fix from upstream. 

Only information is that the issue was fixed between 2.14rc15 and 2.14rc16 (git log at [0]).

[0] https://repo.or.cz/nasm.git/shortlog/28b69e2a633a850e724f309a5ec81bac8638084a
Comment 2 Robert Frohl 2018-11-13 15:37:44 UTC 
git bisect suggests that the patch is this one:
https://repo.or.cz/nasm.git/commitdiff/e996d28c70d45008085322b442b44a9224308548

using the reproducer:
./nasm -f bin poc2 -o xxx
Comment 3 Robert Frohl 2018-11-13 15:38:35 UTC 
Created attachment 789552 [details]
QA Reproducer

$ nasm -f bin poc2 -o xxx
Comment 4 Robert Frohl 2018-11-13 15:50:46 UTC 
Problem was introduced by:
https://repo.or.cz/nasm.git/commitdiff/98578071b9d71ecaa2344dd9c185237c1765041e

git tag --contains 98578071b9d71ecaa2344dd9c185237c1765041e
nasm-2.14
nasm-2.14rc1
..
nasm-2.14rc16
-> Suse is not affected as we only ship 2.13.X and older