Bug 1190613 (CVE-2021-37137) - VUL-0: CVE-2021-37137: netty: netty-codec: SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way
Summary: VUL-0: CVE-2021-37137: netty: netty-codec: SnappyFrameDecoder doesn't restric...
Status: RESOLVED FIXED
Alias: CVE-2021-37137
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/310037/
Whiteboard: CVSSv3.1:SUSE:CVE-2021-37137:7.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2021-09-17 14:00 UTC by Gabriele Sonnu
Modified: 2024-05-31 13:10 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Gabriele Sonnu 2021-09-17 14:00:53 UTC
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

Reference:
https://github.com/netty/netty/security/advisories/GHSA-9vjp-v76f-g363

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2004135
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37137
Comment 1 Gabriele Sonnu 2021-09-17 14:01:44 UTC
Affected packages:

 - SUSE:SLE-15-SP1:Update:Products:Manager40:Update/netty  4.1.8.Final
 - SUSE:SLE-15-SP2:Update:Products:Manager41:Update/netty  4.1.44.Final
 - SUSE:SLE-15-SP3:Update:Products:Manager42:Update/netty  4.1.44.Final
 - openSUSE:Backports:SLE-15-SP2/netty                     4.1.13
 - openSUSE:Backports:SLE-15-SP3/netty                     4.1.13
 - openSUSE:Backports:SLE-15-SP4/netty                     4.1.13
 - openSUSE:Factory/netty                                  4.1.60

Upstream patch:

https://github.com/netty/netty/commit/6da4956b31023ae967451e1d94ff51a746a9194f
Comment 4 Swamp Workflow Management 2022-04-20 10:27:24 UTC
SUSE-SU-2022:1271-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1182103,1183262,1190610,1190613,1193672
CVE References: CVE-2021-21290,CVE-2021-21295,CVE-2021-37136,CVE-2021-37137,CVE-2021-43797
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    netty-4.1.75-150200.4.6.2
openSUSE Leap 15.3 (src):    netty-4.1.75-150200.4.6.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 6 Thomas Leroy 2022-09-08 12:36:10 UTC
Reassigning to Pedro for SUMA codestreams.

Pedro, could you please ensure that SUSE:SLE-15-SP2:Update:Products:Manager41:Update/netty and SUSE:SLE-15-SP3:Update:Products:Manager42:Update/netty will get the fix for this CVE? :)

Again, if you finally plan to release a new 4.0 version, please include a fix for this bug.
Comment 7 Thomas Leroy 2022-09-08 12:55:52 UTC
(In reply to Thomas Leroy from comment #6)
> Reassigning to Pedro for SUMA codestreams.
> 
> Pedro, could you please ensure that
> SUSE:SLE-15-SP2:Update:Products:Manager41:Update/netty and
> SUSE:SLE-15-SP3:Update:Products:Manager42:Update/netty will get the fix for
> this CVE? :)
> 
> Again, if you finally plan to release a new 4.0 version, please include a
> fix for this bug.

I guess Julio is the correct person. My apologies for the confusion
Comment 9 Swamp Workflow Management 2022-10-18 16:25:01 UTC
SUSE-SU-2022:3617-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1168932,1182103,1190610,1190613
CVE References: CVE-2020-11612,CVE-2021-21290,CVE-2021-37136,CVE-2021-37137
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for SUSE Manager Server 4.2 (src):    netty-4.1.44.Final-150300.4.3.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2022-10-26 14:18:50 UTC
SUSE-SU-2022:3760-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1168932,1182103,1190610,1190613
CVE References: CVE-2020-11612,CVE-2021-21290,CVE-2021-37136,CVE-2021-37137
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for SUSE Manager Server 4.3 (src):    netty-4.1.44.Final-150400.3.3.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2022-10-27 13:24:35 UTC
SUSE-SU-2022:3793-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1168932,1182103,1190610,1190613
CVE References: CVE-2020-11612,CVE-2021-21290,CVE-2021-37136,CVE-2021-37137
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for SUSE Manager Server 4.1 (src):    netty-4.1.44.Final-150200.3.4.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Andrea Mattiazzo 2024-05-31 13:10:02 UTC
All done, closing.