Bug 1196177 - (CVE-2022-0530) VUL-0: CVE-2022-0530: unzip: SIGSEGV during the conversion of an utf-8 string to a local string
(CVE-2022-0530)
VUL-0: CVE-2022-0530: unzip: SIGSEGV during the conversion of an utf-8 string...
Status: NEW
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/322962/
CVSSv3.1:SUSE:CVE-2022-0530:4.7:(AV:L...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2022-02-18 15:51 UTC by Gabriele Sonnu
Modified: 2022-09-27 12:39 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
debian patch (898 bytes, patch)
2022-09-20 14:08 UTC, Gabriele Sonnu
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Gabriele Sonnu 2022-02-18 15:53:40 UTC
Same as bnc#1196175, can't reproduce on SLE-12, SLE-15 and Factory, the command will simply return "error:  zipfile probably corrupt (segmentation violation)".
Looking at the patch seems we already have some kind of mitigation in place there for the newer SLE and Factory.

Tracking as affected:

 - SUSE:SLE-11-SP1:Update/unzip   5.52
 - SUSE:SLE-11-SP2:Update/unzip   6.00

No patch available for now.
Comment 2 Danilo Spinella 2022-02-24 08:46:37 UTC
Does this have the same fix as bsc#1196175?
Comment 3 Gabriele Sonnu 2022-02-24 09:14:52 UTC
Hi Danilo,

There's no patch for now, I'm not sure if the fix is the same. 
The main bug is private. I downloaded a reproducer last week but now I don't seem to find it anymore.
Comment 4 Gabriele Sonnu 2022-09-20 14:08:14 UTC
Created attachment 861575 [details]
debian patch

Added Debian patch, from [0]. Reproducers can be found in [1].

[0] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1010355
[1] https://github.com/ByteHackr/unzip_poc
Comment 6 Danilo Spinella 2022-09-21 09:11:00 UTC
(In reply to Gabriele Sonnu from comment #1)
> Same as bnc#1196175, can't reproduce on SLE-12, SLE-15 and Factory, the
> command will simply return "error:  zipfile probably corrupt (segmentation
> violation)".
> Looking at the patch seems we already have some kind of mitigation in place
> there for the newer SLE and Factory.

The patch applies fine to SLE-12, so I would still apply it to SLE-12, SLE-15 and openSUSE:Factory, if it is okay for you.
Comment 9 Gabriele Sonnu 2022-09-21 09:57:02 UTC
(In reply to Danilo Spinella from comment #6)
> The patch applies fine to SLE-12, so I would still apply it to SLE-12,
> SLE-15 and openSUSE:Factory, if it is okay for you.

If you think there's no potential regression/bug please do.
Comment 10 Danilo Spinella 2022-09-21 12:24:16 UTC
(In reply to Gabriele Sonnu from comment #9)
> (In reply to Danilo Spinella from comment #6)
> > The patch applies fine to SLE-12, so I would still apply it to SLE-12,
> > SLE-15 and openSUSE:Factory, if it is okay for you.
> 
> If you think there's no potential regression/bug please do.

I don't there could be a regression, this patch just add some NULL checks.
Comment 12 Andreas Stieger 2022-09-26 15:40:07 UTC
Fix missing in unzip-rcc, pre-checkin was not run. Should be singlespec!


-# PATCH-FIX-UPSTREAM danilo.spinella@suse.com CVE-2022-0530 bsc#1196177
-Patch24:        CVE-2022-0530.patch
-# PATCH-FIX-UPSTREAM danilo.spinella@suse.com CVE-2022-0529 bsc#1196180
-Patch25:        CVE-2022-0529.patch

-%patch24 -p1
-%patch25 -p1
Comment 13 Swamp Workflow Management 2022-09-26 16:28:51 UTC
SUSE-SU-2022:3386-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1196177,1196180
CVE References: CVE-2022-0529,CVE-2022-0530
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    unzip-6.00-33.16.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Swamp Workflow Management 2022-09-26 19:26:30 UTC
SUSE-SU-2022:3399-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1196177,1196180
CVE References: CVE-2022-0529,CVE-2022-0530
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    unzip-6.00-150000.4.11.1
openSUSE Leap 15.3 (src):    unzip-6.00-150000.4.11.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    unzip-6.00-150000.4.11.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    unzip-6.00-150000.4.11.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.