Debian Bug report logs - #779392
glibc: CVE-2015-8985: potential denial of service in pop_fail_stack()

Package: libc6; Maintainer for libc6 is GNU Libc Maintainers <debian-glibc@lists.debian.org>; Source for libc6 is src:glibc (PTS, buildd, popcon).

Reported by: Jakub Wilk <jwilk@debian.org>

Date: Sat, 28 Feb 2015 00:21:07 UTC

Severity: normal

Tags: fixed-upstream, security

Found in version glibc/2.19-15

Fixed in version glibc/2.28-0experimental0

Done: Salvatore Bonaccorso <carnil@debian.org>

Bug is archived. No further changes may be made.

Forwarded to https://sourceware.org/bugzilla/show_bug.cgi?id=21163

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to debian-bugs-dist@lists.debian.org, jwilk@debian.org, GNU Libc Maintainers <debian-glibc@lists.debian.org>:
Bug#779392; Package libc6. (Sat, 28 Feb 2015 00:21:11 GMT) (full text, mbox, link).

Message #3 received at submit@bugs.debian.org (full text, mbox, reply):

[Message part 1 (text/plain, inline)]

Package: libc6
Version: 2.19-15
Tags: security
Usertags: afl

The attached test program, which compiles an invalid regexp and then 
tries to match a string against it, triggers an assertion:

$ make CFLAGS=-Wall pop_fail_stack
cc -Wall    pop_fail_stack.c   -o pop_fail_stack

$ ./pop_fail_stack
pop_fail_stack: regexec.c:1401: pop_fail_stack: Assertion `num >= 0' failed.
Aborted


This bug was found using American fuzzy lop:
http://lcamtuf.coredump.cx/afl/
(available in Debian experimental)


-- System Information:
Debian Release: 8.0
 APT prefers unstable
 APT policy: (990, 'unstable'), (500, 'experimental')
Architecture: i386 (x86_64)
Foreign Architectures: amd64

Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=C, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages libc6 depends on:
ii  libgcc1  1:5-20150226-1

Versions of packages libc6 recommends:
ii  libc6-i686  2.19-15

Versions of packages libc6 suggests:
ii  debconf [debconf-2.0]  1.5.55
ii  glibc-doc              2.19-15
ii  locales                2.19-15

-- 
Jakub Wilk

[pop_fail_stack.c (text/x-csrc, attachment)]

Removed tag(s) security. Request was from Jakub Wilk <jwilk@debian.org> to control@bugs.debian.org. (Fri, 20 Mar 2015 16:33:04 GMT) (full text, mbox, link).

Set Bug forwarded-to-address to 'https://sourceware.org/bugzilla/show_bug.cgi?id=21163'. Request was from Florian Weimer <fweimer@redhat.com> to control@bugs.debian.org. (Tue, 14 Feb 2017 18:57:02 GMT) (full text, mbox, link).

Added tag(s) security. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Tue, 14 Feb 2017 19:09:04 GMT) (full text, mbox, link).

Changed Bug title to 'glibc: CVE-2015-8985: potential denial of service in pop_fail_stack()' from 'libc6: regexec.c:1401: pop_fail_stack: Assertion `num >= 0' failed'. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Tue, 14 Feb 2017 19:09:06 GMT) (full text, mbox, link).

Added tag(s) fixed-upstream. Request was from debian-bts-link@lists.debian.org to control@bugs.debian.org. (Fri, 06 Jul 2018 01:00:13 GMT) (full text, mbox, link).

Marked as fixed in versions glibc/2.28-0experimental0. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sun, 06 Jan 2019 13:15:05 GMT) (full text, mbox, link).

Marked Bug as done Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sun, 06 Jan 2019 13:15:05 GMT) (full text, mbox, link).

Notification sent to Jakub Wilk <jwilk@debian.org>:
Bug acknowledged by developer. (Sun, 06 Jan 2019 13:15:06 GMT) (full text, mbox, link).

Message sent on to Jakub Wilk <jwilk@debian.org>:
Bug#779392. (Sun, 06 Jan 2019 13:15:08 GMT) (full text, mbox, link).

Message #22 received at 779392-submitter@bugs.debian.org (full text, mbox, reply):

close 779392 2.28-0experimental0
thanks

Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Mon, 04 Feb 2019 07:52:05 GMT) (full text, mbox, link).

Send a report that this bug log contains spam.

Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Mon Jul 15 15:05:58 2024; Machine Name: bembo

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Debian Bug report logs - #779392 glibc: CVE-2015-8985: potential denial of service in pop_fail_stack()

Debian Bug report logs - #779392
glibc: CVE-2015-8985: potential denial of service in pop_fail_stack()