[Bug regex/30833] New: Segmentation fault in glibc 2.35, regcomp.c

[Bug regex/30833] New: Segmentation fault in glibc 2.35, regcomp.c

[aasmita at ucdavis dot edu]

https://sourceware.org/bugzilla/show_bug.cgi?id=30833

            Bug ID: 30833
           Summary: Segmentation fault in glibc 2.35, regcomp.c
           Product: glibc
           Version: 2.35
            Status: UNCONFIRMED
          Severity: minor
          Priority: P2
         Component: regex
          Assignee: unassigned at sourceware dot org
          Reporter: aasmita at ucdavis dot edu
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

Created attachment 15103
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15103&action=edit
It contains doc with details about the bug, the pattern that caused bug,
corresponding screenshot.

Version - Glibc 2.35 , was also reproducible in Glibc 2.38
Machine on which it was tested - 
`Uname -a` :  Linux xxxx 5.19.0-45-generic #46~22.04.1-Ubuntu SMP
PREEMPT_DYNAMIC Wed Jun 7 15:06:04 UTC 20 x86_64 x86_64 x86_64 GNU/Linux

( Was also reproducible on a debian based system).
Note : Both Glibc 2.35 and 2.38 were compiled from the source code. (And was
also tested with the one that came with distro. Issue was found in both)


Issue : In regcomp() denial of service (DoS) by stack exhaustion. Triggers deep
recursion that causes stack exhaustion.

It’s similar to CVE-2010-4051 and it occurred in these latest glibc versions as
well.

Two types of pattern that caused the  issue are : 

1st pattern : long repeated ‘(((((((((((.........” and 
2nd pattern : “/????{,29999}}”

It leads to deep recursion causing stack exhaustion and hence Segmentation
fault.


Note : This work is done together with Yaroslav Oliinyk (
yaroslav.oliinyk@netrise.io) while doing my internship at Netrise

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug regex/30833] Segmentation fault in glibc 2.35, regcomp.c

[aasmita at ucdavis dot edu]

https://sourceware.org/bugzilla/show_bug.cgi?id=30833

Asmita <aasmita at ucdavis dot edu> <aasmita at ucdavis dot edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aasmita at ucdavis dot edu,
                   |                            |yaroslav.oliinyk at netrise dot io

-- 
You are receiving this mail because:
You are on the CC list for the bug.