oss-security - CVE request: flex: Buffer overflow in generated code (yy_get_next

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160718145438.GB10685@ZEDAT.FU-Berlin.DE>
Date: Mon, 18 Jul 2016 16:54:38 +0200
From: Alexander Sulfrian <asulfrian@...AT.FU-Berlin.DE>
To: oss-security@...ts.openwall.com
Subject: CVE request: flex: Buffer overflow in generated code
 (yy_get_next_buffer)

Hi,

flex upstream change some integer type in 2.5.36[1] to unsigned integer
types (size_t). Especially the num_to_read variable in
yy_get_next_buffer is critical, because the buffer is resized if this
value is _less_ or equal to zero.

With special crafted input it is possible, that the buffer is not
resized if the input is larger than the default buffer size of 16k. This
allows a heap buffer overflow.

It may be also remote usable, it depends on the software that is build
using flex. We noticed for example, that bogofilter segfaults sometimes
depending on the incoming mail.

Upstream already noticed that this may be a problem[2] but did not
escalate it as a security issue. Upstream also changed some other type
back from size_t to int (for example in [3]) so maybe it is not
sufficient to only change num_to_read back to int.

The upstream fix is contained in 2.6.1, but there are more integer type
fixes in the master branch of flex (currently not in a released
version).

As the issue is in the generated code during compile time, it is not
sufficient to fix flex, but all binaries using flex as build-dependency
may need a rebuild after fixing flex. Additinally there may be packages,
that supply the generated source in the release-tar and do not use flex
during building.

Could you please assign a CVE for this issue?

Thanks,
Alexander Sulfrian

1: https://github.com/westes/flex/commit/9ba3187a537d6a58d345f2874d06087fd4050399
2: https://github.com/westes/flex/commit/a5cbe929ac3255d371e698f62dc256afe7006466
3: https://github.com/westes/flex/commit/7a7c3dfe1bcb8230447ba1656f926b4b4cdfc457

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.