Bug 7181

Summary: rpm: CVE-2014-8118 & CVE-2013-6435
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Sona Sarmadi <sona.sarmadi>
Component: devtools / tool chainAssignee: Leonardo Sandoval Gonzalez <leonardo.sandoval.gonzalez>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: Medium CC: leonardo.sandoval.gonzalez, meta.mr.watcher, meta.watcher
Version: unspecified   
Target Milestone: 1.8.1   
Hardware: All   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)

Description Sona Sarmadi 2015-01-19 09:02:50 UTC 
Two vulnerabilities in RPM:

CVE-2014-8118 integer overflow and stack overflow in CPIO header parsing 
CVE-2013-6435 race condition during the installation process

From the Red Hat advisory:

It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system interprets the unverified temporary file contents and extracts commands from it. This could allow an attacker to modify signed RPM files in such a way that they would execute code chosen by the attacker during package installation. (CVE-2013-6435)

It was found that RPM could encounter an integer overflow, leading to a stack-based buffer overflow, while parsing a crafted CPIO header in the payload section of an RPM file. This could allow an attacker to modify signed RPM files in such a way that they would execute code chosen by the attacker during package installation. (CVE-2014-8118)

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1168715
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6435
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8118
Comment 1 Mark Hatle 2015-01-19 16:01:01 UTC 
I spoke w/ Jeff Johnson the RPM5 maintainer.  He forwarded me the following:

CVE-2014-8118:

rpm5 unaffected afaict because:
    1) size_t not int (so no integer overflow)
    2) malloc'd not automatic stack based input buffer
    3) check on buffer overrun

So unless someone has a reproducer that affects RPM5, this CVE does not apply.
Comment 2 Mark Hatle 2015-04-28 18:25:54 UTC 
Saul, we need someone assigned to investigate any security impact on the RPM4 implemented in 1.8 and master.
Comment 3 Leonardo Sandoval Gonzalez 2015-06-26 20:04:31 UTC 
Now, on master

db34474679587502fe0b6a0a5cd72351e29991a2 rpm: Fix CVE-2013-6435

3886107521ed64d72afb93bfc123f2b81bc4e959 rpm: Fix CVE-2014-8118
Comment 4 Leonardo Sandoval Gonzalez 2015-08-12 22:06:42 UTC 
Commits on master branch:

db34474679587502fe0b6a0a5cd72351e29991a2 Leonardo Sandoval Wed Jun 10 14:58:38 2015 +0000 rpm: Fix CVE-2013-6435
3886107521ed64d72afb93bfc123f2b81bc4e959 Leonardo Sandoval Wed Jun 10 14:55:14 2015 +0000 rpm: Fix CVE-2014-8118