oss-security - GStreamer Security Advisory 2024-0003: Orc compiler stack-based buffer overflow

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <2309f1ae-1898-41f4-a369-c964498e9128@oracle.com>
Date: Fri, 26 Jul 2024 11:57:09 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: GStreamer Security Advisory 2024-0003: Orc compiler stack-based
 buffer overflow

https://gstreamer.freedesktop.org/security/sa-2024-0003.html reports:

> Security Advisory 2024-0003 (JVN#02030803, JPCERT#92912620, CVE-2024-40897)
> 
> Summary                 Orc compiler stack-based buffer overflow
> Date                    2024-07-19 12:30
> Affected Versions       orc < 0.4.39
> IDs                     GStreamer-SA-2024-0003
>                         JVN#02030803 / JPCERT#92912620
>                         CVE-2024-40897
>                         
> Details
> -------
> Stack-based buffer overflow in the Orc compiler when formatting error
> messages for certain input files.
> 
> Impact
> ------
> It is possible for a malicious third party to trigger a buffer overflow and
> effect code execution with the same privileges as the orc compiler is called
> with by feeding it with malformed orc source files.
> 
> This only affects developers and CI environments using orcc, not users of
> liborc.
> 
> Solution
> --------
> The Orc 0.4.39 release address the issue. People using older branches of
> Orc should apply the patches and recompile.
> 
> Patches: https://gitlab.freedesktop.org/gstreamer/orc/-/merge_requests/191.patch

The commit message on the fix states:

> vasprintf() is a GNU/BSD extension and would allocate as much memory as required
> on the heap, similar to g_strdup_printf(). It's ridiculous that such a function
> is still not provided as part of standard C.

Note that asprintf() and vasprintf() are part of the POSIX.1-2024 standard
which was officially published last month, so these are no longer
system-specific extensions:

https://pubs.opengroup.org/onlinepubs/9799919799/functions/asprintf.html
https://pubs.opengroup.org/onlinepubs/9799919799/functions/vasprintf.html

though they are not yet part of the C standard itself.

-- 
         -Alan Coopersmith-                 alan.coopersmith@...cle.com
          Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.