[Bug libc/18016] New: Signed size comparison in memcpy-ssse3.S (CVE-2011-2702)

[Bug libc/18016] New: Signed size comparison in memcpy-ssse3.S (CVE-2011-2702)

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18016

            Bug ID: 18016
           Summary: Signed size comparison in memcpy-ssse3.S
                    (CVE-2011-2702)
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
                CC: drepper.fsp at gmail dot com
             Flags: security+

CVE mapping is based on an archived copy of
http://www.nodefense.org/eglibc.txt.

The signed comparison in __memcpy_ssse3 means that an out-of-bounds reference
is used for the jump table, which allows code execution and ASLR bypass (due to
the relative addressing).

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18016] Signed size comparison in memcpy-ssse3.S (CVE-2011-2702)

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18016

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #1 from Florian Weimer <fweimer at redhat dot com> ---
Fixed in commit a0ac24d98ace90d1ccba6a2f3e7d55600f2fdb6e, which went into glibc
2.12.

The bug was introduced in commit 3af48cbdfaeb8bc389de1caeb33bc29811da80e8,
which happened after the 2.11 release, but it seems that this ended up in some
eglibc releases and downstreams.

-- 
You are receiving this mail because:
You are on the CC list for the bug.