oss-security - CVE request: screen stack overflow (deep recursion)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <87vbbusojr.fsf@mid.deneb.enyo.de>
Date: Tue, 01 Sep 2015 07:20:56 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: cve-assign@...re.org
Cc: oss-security@...ts.openwall.com
Subject: CVE request: screen stack overflow (deep recursion)

Upstream bug report by Kuang-che Wu:

“
How to reproduce:
Run this command inside screen
$ printf '\x1b[10000000T'

screen will recursively call MScrollV to depth n/256. This is time consuming and will overflow stack if n is huge.
”

<https://savannah.gnu.org/bugs/?45713>

Upstream fix:

http://git.savannah.gnu.org/cgit/screen.git/commit/?id=b7484c224738247b510ed0d268cd577076958f1b

Debian bug:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=797624

MScrollV creates a very large stack frame, so it could theoreticall
jump over the guard page at the top of the stack, and it might be
feasible to exploit this for something else besides denial-of-service.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.