[Bug 1877402] New: perl-dbi: Memory corruption in XS functions when Perl stack is reallocated

https://bugzilla.redhat.com/show_bug.cgi?id=1877402

            Bug ID: 1877402
           Summary: perl-dbi: Memory corruption in XS functions when Perl
                    stack is reallocated
           Product: Security Response
          Hardware: All
                OS: Linux
            Status: NEW
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: security-response-team(a)redhat.com
          Reporter: psampaio(a)redhat.com
                CC: caillon+fedoraproject(a)gmail.com, hhorak(a)redhat.com,
                    john.j5live(a)gmail.com, jorton(a)redhat.com,
                    jplesnik(a)redhat.com, kasal(a)ucw.cz,
                    perl-devel(a)lists.fedoraproject.org,
                    perl-maint-list(a)redhat.com, ppisar(a)redhat.com,
                    rhughes(a)redhat.com, rstrode(a)redhat.com,
                    sandmann(a)redhat.com
  Target Milestone: ---
    Classification: Other



A flaw was found in perl-dbi. Macro ST(*) returns pointer to Perl stack. Other
Perl functions which use Perl stack (e.g. eval) may reallocate Perl stack and
therefore pointer returned by ST(*) macro is invalid which may lead to memory
corruption.

Upstream patch:

https://github.com/perl5-dbi/dbi/commit/ea99b6aafb437db53c28fd40d5eafbe11...


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877402] perl-dbi: Memory corruption in XS functions when Perl stack is reallocated

https://bugzilla.redhat.com/show_bug.cgi?id=1877402

Pedro Sampaio <psampaio(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1877403





Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1877403
[Bug 1877403] perl-DBI: Memory corruption in XS functions when Perl stack is
reallocated [fedora-all]
-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877402] perl-dbi: Memory corruption in XS functions when Perl stack is reallocated

https://bugzilla.redhat.com/show_bug.cgi?id=1877402

Pedro Sampaio <psampaio(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Comment|0                           |updated



--- Comment #1 from Pedro Sampaio <psampaio(a)redhat.com&gt; ---
Created perl-DBI tracking bugs for this issue:

Affects: fedora-all [bug 1877403]

--- Comment #0 has been edited ---

A flaw was found in perl-dbi. Macro ST(*) returns pointer to Perl stack. Other
Perl functions which use Perl stack (e.g. eval) may reallocate Perl stack and
therefore pointer returned by ST(*) macro is invalid which may lead to memory
corruption.

Upstream patch:

https://github.com/perl5-dbi/dbi/commit/ea99b6aafb437db53c28fd40d5eafbe11...

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877402] perl-dbi: Memory corruption in XS functions when Perl stack is reallocated

https://bugzilla.redhat.com/show_bug.cgi?id=1877402



--- Comment #2 from Petr Pisar <ppisar(a)redhat.com&gt; ---
The fix is included in DBI-1.643 upstream release.


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877402] perl-dbi: Memory corruption in XS functions when Perl stack is reallocated

https://bugzilla.redhat.com/show_bug.cgi?id=1877402

Pedro Sampaio <psampaio(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1857388




-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877402] perl-dbi: Memory corruption in XS functions when Perl stack is reallocated

https://bugzilla.redhat.com/show_bug.cgi?id=1877402

Todd Cullum <tcullum(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1877497, 1877498, 1877499,
                   |                            |1877496




-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877402] CVE-2020-14392 perl-dbi: Memory corruption in XS functions when Perl stack is reallocated

https://bugzilla.redhat.com/show_bug.cgi?id=1877402

Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|perl-dbi: Memory corruption |CVE-2020-14392 perl-dbi:
                   |in XS functions when Perl   |Memory corruption in XS
                   |stack is reallocated        |functions when Perl stack
                   |                            |is reallocated
              Alias|                            |CVE-2020-14392




-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877402] CVE-2020-14392 perl-dbi: Memory corruption in XS functions when Perl stack is reallocated

https://bugzilla.redhat.com/show_bug.cgi?id=1877402

Todd Cullum <tcullum(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|medium                      |low
           Severity|medium                      |low


--- Doc Text *updated* ---
An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker
who is able to manipulate calls to dbd_db_login6_sv() could cause memory corruption,
affecting the service's availability.



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877402] CVE-2020-14392 perl-dbi: Memory corruption in XS functions when Perl stack is reallocated

https://bugzilla.redhat.com/show_bug.cgi?id=1877402



--- Comment #5 from Todd Cullum <tcullum(a)redhat.com&gt; ---
External References:

Advisory:
https://metacpan.org/pod/distribution/DBI/Changes#Changes-in-DBI-1.643-...


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877402] CVE-2020-14392 perl-dbi: Memory corruption in XS functions when Perl stack is reallocated

https://bugzilla.redhat.com/show_bug.cgi?id=1877402
Bug 1877402 depends on bug 1877403, which changed state.

Bug 1877403 Summary: CVE-2020-14392 perl-DBI: Memory corruption in XS functions when Perl
stack is reallocated [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1877403

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA




-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877402] CVE-2020-14392 perl-dbi: Memory corruption in XS functions when Perl stack is reallocated

https://bugzilla.redhat.com/show_bug.cgi?id=1877402


--- Doc Text *updated* by RaTasha Tillery-Smith <rtillery(a)redhat.com&gt; ---
An untrusted pointer dereference flaw was found in Perl-DBI before version 1.643. This
flaw allows a local attacker who can manipulate calls to dbd_db_login6_sv() to cause
memory corruption. The highest threat from this vulnerability is to system availability.



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877402] CVE-2020-14392 perl-dbi: Memory corruption in XS functions when Perl stack is reallocated

https://bugzilla.redhat.com/show_bug.cgi?id=1877402

Todd Cullum <tcullum(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |WONTFIX
        Last Closed|                            |2021-11-02 17:24:39




-- 
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1877402