Bug 1066649 – VUL-1: CVE-2017-16231: pcre: match() stack overflow

Bug 1066649 - (CVE-2017-16231) VUL-1: CVE-2017-16231: pcre: match() stack overflow

(CVE-2017-16231)
Summary:	VUL-1: CVE-2017-16231: pcre: match() stack overflow

Status:	RESOLVED INVALID

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Minor
Target Milestone:	---
Assigned To:	Stephan Kulow
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/194449/
Whiteboard:	CVSSv2:NVD:CVE-2017-16231:2.1:(AV:L/...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2017-11-06 12:00 UTC by Victor Pereira
Modified:	2020-04-01 17:00 UTC (History)
CC List:	3 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
proof of concept to be used with pcretest (23.29 KB, text/plain) 2017-11-06 12:00 UTC, Victor Pereira	Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Victor Pereira 2017-11-06 12:00:07 UTC

Created attachment 747250 [details]
proof of concept to be used with pcretest

CVE-2017-16231

after compiling, a pcretest load test PoC produces a crash overflow
in the function match() in pcre_exec.c because of a self-recursive call.



References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16231
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16231.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16231

Comment 1 Andreas Stieger 2018-09-04 11:53:24 UTC

Upstream rejected the issue: https://bugs.exim.org/show_bug.cgi?id=2047

It is very easy to write patterns that have extremely large search trees, and these can consume a lot of time and/or stack in the current implementation of pcre2_match(). There are options (*LIMIT_MATCH) and (*LIMIT_RECURSION) that can be used to limit the amount of stack that is used. The limits can also be set from pcretest and from programs that call the library directly. This is all well documented.



I agree, closing