CVE-2011-3378: Code Injection
Created attachment 525110 [details] testcase
Description of problem:
int off = ntohl(pe->offset);
if (hdrchkData(off)) goto errxit; if (off) { sizet nb = REGIONTAGCOUNT; int32t stei[nb]; / XXX Hmm, why the copy? / memcpy(&stei, dataStart + off, nb);
No check for dataStart + off > dataEnd.
(gdb) r --checksig rpminput.rpm [Thread debugging using libthreaddb enabled] Using host libthreaddb library "/lib/libthreaddb.so.1". error: no dbpath has been set error: cannot open Packages database in /%{dbpath}
Program received signal SIGSEGV, Segmentation fault. memcpy () at ../sysdeps/x8664/memcpy.S:117 117 ../sysdeps/x8664/memcpy.S: No such file or directory. in ../sysdeps/x8664/memcpy.S (gdb) bt #0 memcpy () at ../sysdeps/x8664/memcpy.S:117 #1 0x00007ffff7946493 in headerLoad (uh=0x623e00) at header.c:831 #2 0x00007ffff7946af9 in headerRead (fd=0x622180, magicp=HEADERMAGICYES) at header.c:994 #3 0x00007ffff79731d1 in readFile (fd=0x622180, fn=0x60a080 "rpminput.rpm", dig=0x622ab0, plbundle=0x6223b0, hdrbundle=0x622420) at rpmchecksig.c:462 #4 0x00007ffff7973c29 in rpmpkgVerifySigs (keyring=0x620ef0, flags=1572865, fd=0x622180, fn=0x60a080 "rpminput.rpm") at rpmchecksig.c:689 #5 0x00007ffff797429e in rpmcliSign (ts=0x621630, qva=0x7ffff7bab180, argv=0x609ed8) at rpmchecksig.c:824 #6 0x00000000004036e0 in main (argc=3, argv=0x7fffffffe458) at rpmqv.c:787
Other sources
RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3378?
CVE-2011-3378 is classified as a moderate severity vulnerability.
How do I fix CVE-2011-3378?
To fix CVE-2011-3378, upgrade to the versions of RPM specified by your distribution's security advisory.
What impact does CVE-2011-3378 have on affected systems?
CVE-2011-3378 may allow a remote attacker to cause a denial of service or execute arbitrary code.
Which versions of RPM are affected by CVE-2011-3378?
CVE-2011-3378 primarily affects RPM versions up to 4.8.0.
Is there a patch available for CVE-2011-3378?
Yes, patches for CVE-2011-3378 are available through official channels for affected versions of RPM.