public inbox for glibc-bugs-regex@sourceware.org help / color / mirror / Atom feed
From: "aasmita at ucdavis dot edu" <sourceware-bugzilla@sourceware.org> To: glibc-bugs-regex@sourceware.org Subject: [Bug regex/30833] New: Segmentation fault in glibc 2.35, regcomp.c Date: Thu, 07 Sep 2023 18:57:19 +0000 [thread overview] Message-ID: <bug-30833-132@http.sourceware.org/bugzilla/> (raw) https://sourceware.org/bugzilla/show_bug.cgi?id=30833 Bug ID: 30833 Summary: Segmentation fault in glibc 2.35, regcomp.c Product: glibc Version: 2.35 Status: UNCONFIRMED Severity: minor Priority: P2 Component: regex Assignee: unassigned at sourceware dot org Reporter: aasmita at ucdavis dot edu CC: drepper.fsp at gmail dot com Target Milestone: --- Created attachment 15103 --> https://sourceware.org/bugzilla/attachment.cgi?id=15103&action=edit It contains doc with details about the bug, the pattern that caused bug, corresponding screenshot. Version - Glibc 2.35 , was also reproducible in Glibc 2.38 Machine on which it was tested - `Uname -a` : Linux xxxx 5.19.0-45-generic #46~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Wed Jun 7 15:06:04 UTC 20 x86_64 x86_64 x86_64 GNU/Linux ( Was also reproducible on a debian based system). Note : Both Glibc 2.35 and 2.38 were compiled from the source code. (And was also tested with the one that came with distro. Issue was found in both) Issue : In regcomp() denial of service (DoS) by stack exhaustion. Triggers deep recursion that causes stack exhaustion. It’s similar to CVE-2010-4051 and it occurred in these latest glibc versions as well. Two types of pattern that caused the issue are : 1st pattern : long repeated ‘(((((((((((.........” and 2nd pattern : “/????{,29999}}” It leads to deep recursion causing stack exhaustion and hence Segmentation fault. Note : This work is done together with Yaroslav Oliinyk ( yaroslav.oliinyk@netrise.io) while doing my internship at Netrise -- You are receiving this mail because: You are on the CC list for the bug.
next reply other threads:[~2023-09-07 18:57 UTC|newest] Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top 2023-09-07 18:57 aasmita at ucdavis dot edu [this message] 2023-09-07 18:58 ` [Bug regex/30833] " aasmita at ucdavis dot edu
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-30833-132@http.sourceware.org/bugzilla/ \ --to=sourceware-bugzilla@sourceware.org \ --cc=glibc-bugs-regex@sourceware.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).