oss-security - Re: LMS-2014-06-16-6: LZ4 Core

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140627023740.GA26647@openwall.com>
Date: Fri, 27 Jun 2014 06:37:40 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: LMS-2014-06-16-6: LZ4 Core

On Thu, Jun 26, 2014 at 12:58:37PM -0600, Don A. Bailey wrote:
> A vulnerability has been identified in the LZ4 core implementation. Please
> review the bug report attached inline.
[...]
> Report ID: LMS-2014-06-16-6
> 
> CVE ID: CVE-2014-4611
[...]
> Vulnerability Status: Reported / No response

Yann Collet, the author of LZ4 and maintainer of the LZ4 reference
implementation, has now posted a different point of view:

http://fastcompression.blogspot.fr/2014/06/debunking-lz4-20-years-old-bug-myth.html

Aside from the bitterness (which I think is excessive, albeit
understandable), there's technical detail on why the vulnerability is
less severe, and a mention of it having been reported via "a brief note
on the LZ4 issue board".  I've just found this note here:

https://code.google.com/p/lz4/issues/detail?id=52&can=1

I guess there was some miscommunication, because there _was_ response
via comments on this issue.  Don's comment was posted on June 19, and
Yann replied via multiple comments on June 20, 22, 26.  The latest one
of these says "Fixed into r118", which is:

https://code.google.com/p/lz4/source/detail?r=118

and the commit message includes:

"fix :  Issue 52  (malicious address space overflow in 32-bits mode when using custom format)"

Per Yann's blog post, and per comments on issue 52, we should credit
Ludvig Strigeus for earlier discovery of this issue specifically in LZ4,
although it was not treated as a security issue until Don's rediscovery
(per Yann's good reasons, it shouldn't have been, but that's arguable).

Given the above, I think all of Ludvig, Don, and indeed Yann deserve
credit for getting this issue fixed, and I find it unfortunate that
feelings were hurt.

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.