REDHAT-BUG-2543229: High severity Gnome libsoup vulnerability
A type-confusion heap overflow was found in libsoup's WebSocket Pong handling.
SoupWebsocketConnection::pong is declared to deliver a GBytes payload, but receivepong() emitted a GByteArray pointer via gsignalemit() and then unreffed the GByteArray. Handlers that treated the argument as GBytes (as documented) operated on the wrong object layout, resulting in heap memory corruption / overflow conditions under ASan.
Fixed upstream by converting the buffer with gbytearrayfreetobytes() before emission (commit d2cbaf25, libsoup 3.7.3).
References: https://gitlab.gnome.org/GNOME/libsoup/-/workitems/554 (Bug 2) https://gitlab.gnome.org/GNOME/libsoup/-/commit/d2cbaf25
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libsoupto a version that resolves this vulnerability.Fixed in 3.7.3Patch d2cbaf25
Event History
Frequently Asked Questions
What conditions are required to trigger the memory corruption?
A WebSocket Pong message must be received and an application handler for SoupWebsocketConnection::pong must process the payload as the documented GBytes type. The vulnerable code emits a GByteArray pointer instead, so handlers using the documented object layout can access invalid memory.
Which versions contain the upstream fix?
The issue was fixed upstream in libsoup 3.7.3. The fix converts the Pong buffer to GBytes with g_byte_array_free_to_bytes() before emitting the signal.
How can I determine whether an application may be affected?
Check whether it uses libsoup WebSocket connections and registers a handler for the SoupWebsocketConnection::pong signal that treats its payload as GBytes. An affected build emits the payload from receive_pong() as a GByteArray pointer rather than a GBytes object.