Bug 1218982 (CVE-2024-0684) - VUL-0: CVE-2024-0684: coreutils: coreutils: heap overflow in split --line-bytes with very long lines
Summary: VUL-0: CVE-2024-0684: coreutils: coreutils: heap overflow in split --line-byt...
Status: NEW
: 1218890 (view as bug list)
Alias: CVE-2024-0684
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Minor
Target Milestone: ---
Assignee: Raymund Will
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/391680/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-0684:3.3:(AV:L...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-01-19 09:17 UTC by SMASH SMASH
Modified: 2024-02-12 12:25 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
Reproducer (371.85 KB, application/gzip)
2024-02-12 12:02 UTC, Alexander Bergmann
Details

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-01-19 09:17:36 UTC
Since coreutils 9.2 https://github.com/coreutils/coreutils/commit/40bf1591b
introduced a heap overflow issue, which can be triggered like:

    { printf '%131070s\n' ''; printf 'x\n'; printf '%131071s\n' ''; } > in
    split -C 131072 ---io=131072 in

That will dump core, but as with all heap overflows is a potential security issue.
I'll leave it up to you to determine whether a CVE is required.

There is already a patch upstream, but it's not flagged as a security issue, in an abundance of caution, in case this issue in more security sensitive than first envisaged.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-0684
https://bugzilla.redhat.com/show_bug.cgi?id=2258948

Patch:
https://github.com/coreutils/coreutils/commit/c4c5ed8f4.patch
Comment 1 Andrea Mattiazzo 2024-01-19 09:18:10 UTC
Tracking as affected:
 - SUSE:ALP:Source:Standard:1.0/coreutils  9.4 @ src/split.c:803,823
 - openSUSE:Factory/coreutils              9.4 @ src/split.c:803,823
Comment 2 Thomas Leroy 2024-01-23 08:37:02 UTC
*** Bug 1218890 has been marked as a duplicate of this bug. ***
Comment 3 Alexander Bergmann 2024-02-12 12:02:01 UTC
Created attachment 872656 [details]
Reproducer

The above reproducer is a TAR archive. To use it you only have to gunzip the file and do the following steps:

1. Download the latest Tumbleweed version oder install ALP.

podman pull registry.opensuse.org/opensuse/tumbleweed

2. Download the reproducer

3. Run the podman container with access to the reproducer.

podman run -it -v ~/reproducer:/reproducer opensuse/tumbleweed:latest /bin/bash

4. Inside the container run the split command

cd /reproducer/
split -C 1024 ./split_me
malloc(): corrupted top size
Aborted (core dumped)

The latest Tumbleweed version has the fix already.
Comment 4 OBSbugzilla Bot 2024-02-12 12:25:01 UTC
This is an autogenerated message for OBS integration:
This bug (1218982) was mentioned in
https://build.opensuse.org/request/show/1146149 Factory / coreutils