CVE-2014-3564: Buffer Overflow
Created attachment 912217 [details] Patch fixing the overflow
Description of problem: A bug in GPGME crashes my KMail reproducibly when opening the private key selection dialog twice in a row.
The crash is due to an overflow of the gpgsm->colon.attic.line buffer within statushandler() in engine-gpgsm.c. This buffer is getting (re)allocated at line 831 like this:
if (gpgsm->colon.attic.linesize < alinelen + linelen + 1) { char newline = realloc (aline, alinelen + linelen + 1); gpgsm->colon.attic.linesize += linelen + 1; ...
So in other words, the code allocates a buffer to be alinelen + linelen + 1 bytes long, but then thinks its capacity is actually linesize + linelen + 1. This assumption is wrong if alinelen (the number of bytes used in the buffer prior to reallocation) is lower than linesize (the total length of the buffer), or in other words, if the buffer is not completely full.
In that case, a fragment of the input line is subsequently written past the end of the buffer at line 856:
dst = src++;
I'm not sure if it is really exploitable, but in general this routine is processing arbitrary data coming from certificates the user happens to encounter somehow, so one could possibly exploit this using specially crafted certificate or something like that.
Attached is a trivial patch fixing the issue (works fine for me during daily use of KMail with e-mail signing/encryption).
Version-Release number of selected component (if applicable): gpgme-1.3.2-4.fc20.x8664
How reproducible: Perfectly reproducible for me, but as the bug is data-dependent and I'm not going to publish my keys, I don't have a simple testcase. (I don't think it matters at all as the bug is quite obvious just from the source.)
Other sources
Multiple heap-based buffer overflows in the statushandler function in (1) engine-gpgsm.c and (2) engine-uiserver.c in GPGME before 1.5.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to "different line lengths in a specific order."
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3564?
CVE-2014-3564 is considered to have a moderate severity level, impacting multiple versions of GnuPGME and certain Linux distributions.
How do I fix CVE-2014-3564?
To fix CVE-2014-3564, update GnuPGME to a version that is higher than 1.5.0, or apply the patches provided by your Linux distribution.
What software is affected by CVE-2014-3564?
CVE-2014-3564 affects GnuPGME versions up to 1.5.0 and is also pertinent to specific versions of Ubuntu and Debian Linux.
What type of vulnerability is CVE-2014-3564?
CVE-2014-3564 describes a buffer overflow vulnerability that may allow an attacker to execute arbitrary code.
Is there a known exploit for CVE-2014-3564?
As of now, there is no widely known exploit for CVE-2014-3564, but it is advisable to remediate the vulnerability promptly.