[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <523440C2.2070402@redhat.com>
Date: Sat, 14 Sep 2013 12:56:02 +0200
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: CVE Request: glibc getaddrinfo() stack overflow
On 08/22/2013 09:18 AM, Florian Weimer wrote:
> On 07/04/2013 09:06 PM, Maksymilian wrote:
>>> Perhaps there are some missing CVE ids?
>>
>> In 2011 the problem with alloca() was not defined as a vulnerability.
>>
>> http://sourceware.org/bugzilla/show_bug.cgi?id=12671
>
> I believe the analysis in this bug report is incorrect. The security
> implications are unclear. A straight copy of a long name to a stack
> buffer should trigger a crash because it hits the guard page, but even
> that could be a problem for daemons.
>
> On the other hand, it's impossible to know for sure that no GCC version
> ever lays out the stack in such a way that we end up with a problem.
> Multi-threaded programs linking in script interpreters are more exposed
> to these problems, too.
Kurt told me that the above didn't make it sufficiently clear that I
consider this issue CVE-worthy.
--
Florian Weimer / Red Hat Product Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
