oss-security - CVE request for buffer overrun in CHICKEN Scheme

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140518114318.GC1028@frohike.xs4all.nl>
Date: Sun, 18 May 2014 13:43:18 +0200
From: Peter Bex <Peter.Bex@...all.nl>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: CVE request for buffer overrun in CHICKEN Scheme

Hi all,

I would like to request a CVE for a buffer overrun bug in CHICKEN Scheme
which is very similar to CVE-2013-4385.  It affects a very particular,
not very common use of the read-u8vector! procedure.  If given a buffer
and #f (the Scheme value for "false") as the buffer's size (which should
trigger automatic size detection but doesn't), it will read beyond the
buffer, until the input port (file, socket, etc) is exhausted.  This may
result in the typical potential remote code execution or denial of
service; in CHICKEN, these buffers are initially allocated on the stack
and moved to the heap upon GC.

In normal usage, users would usually pass in the buffer's size.  This
is also the workaround for this bug.

For the official announcement, see
http://lists.gnu.org/archive/html/chicken-announce/2014-05/msg00001.html

The patch on the discussion list is
http://lists.gnu.org/archive/html/chicken-hackers/2014-05/msg00032.html
and it got applied as
http://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git;a=commit;h=1d06ce7e21c7e903ca5dca11fda6fcf2cc52de5e

All versions of CHICKEN prior to 4.9.0 (soon to be released) and 4.8.0.7
(not yet(?) released) are affected.

Cheers,
Peter Bex
-- 
http://www.more-magic.net

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.