Bugzilla – Bug 1050380
VUL-1: libsass: Heap based buffer overflow
Last modified: 2017-11-07 07:35:42 UTC
Created attachment 733701 [details] Reproducer rh#1474276 There is a heap-based buffer over-read in the Sass::Prelexer::re_linebreak function in lexer.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial of service attack. valgrind sassc POC References: https://bugzilla.redhat.com/show_bug.cgi?id=1474276 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-11608 http://www.cvedetails.com/cve/CVE-2017-11608/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11608
Here is the valgrind output with 3.4.6: valgrind ./sassc POC ==32611== Memcheck, a memory error detector ==32611== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al. ==32611== Using Valgrind-3.12.0 and LibVEX; rerun with -h for copyright info ==32611== Command: ./sassc /home/cbosdo/Downloads/POC ==32611== Internal Error: Invalid UTF-8 ==32611== ==32611== HEAP SUMMARY: ==32611== in use at exit: 0 bytes in 0 blocks ==32611== total heap usage: 576 allocs, 576 frees, 120,001 bytes allocated ==32611== ==32611== All heap blocks were freed -- no leaks are possible ==32611== ==32611== For counts of detected and suppressed errors, rerun with: -v ==32611== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0) Looks like the issue has been fixed between 3.4.3 and 3.4.6. SR is on its way to Factory.
After git bisect fun, it seems the commit fixing that is https://github.com/sass/libsass/commit/648f763ede97f9a2c2c843a0a18ac18bbde3507b
Fixed some of the errors. SR sent: https://build.opensuse.org/request/show/537069
release for Leap, done
openSUSE-SU-2017:2939-1: An update that fixes 5 vulnerabilities is now available. Category: security (moderate) Bug References: 1050148,1050149,1050150,1050151,1050380 CVE References: CVE-2017-11554,CVE-2017-11555,CVE-2017-11556,CVE-2017-11605,CVE-2017-11608 Sources used: openSUSE Leap 42.3 (src): libsass-3.3.2-5.1 openSUSE Leap 42.2 (src): libsass-3.3.2-2.3.1