CVE request: missing checks for small-sized files in hivex

[Martin Prpic <mprpic () redhat com>]

Hello,

Can a CVE please be assigned to the following issue?

It was reported that hivex [1], a library that can read and write hive files (undocumented binary files that Windows 
uses to store the Windows Registry on disk), did not properly handle small-sized hive files. An attacker able to supply 
a hive file of a small size to an application using the hivex library could use this flaw to read, and possibly write, 
up to 4095 bytes beyond the end of the allocated buffer, potentially resulting in arbitrary code execution with the 
with the privileges of the user running that application.

This issue has been fixed in upstream version 1.3.11 of hivex. Upstream patches are available at:

https://github.com/libguestfs/hivex/commit/357f26fa64fd1d9ccac2331fe174a8ee9c607adb
https://github.com/libguestfs/hivex/commit/4bbdf555f88baeae0fa804a369a81a83908bd705

References:

[1] https://www.redhat.com/archives/libguestfs/2014-October/msg00235.html
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1167756

Thanks,

--
Martin Prpič / Red Hat Product Security