oss-sec mailing list archives
CVE request for buffer overrun in CHICKEN Scheme
From: Peter Bex <Peter.Bex () xs4all nl>
Date: Sun, 18 May 2014 13:43:18 +0200
Hi all, I would like to request a CVE for a buffer overrun bug in CHICKEN Scheme which is very similar to CVE-2013-4385. It affects a very particular, not very common use of the read-u8vector! procedure. If given a buffer and #f (the Scheme value for "false") as the buffer's size (which should trigger automatic size detection but doesn't), it will read beyond the buffer, until the input port (file, socket, etc) is exhausted. This may result in the typical potential remote code execution or denial of service; in CHICKEN, these buffers are initially allocated on the stack and moved to the heap upon GC. In normal usage, users would usually pass in the buffer's size. This is also the workaround for this bug. For the official announcement, see http://lists.gnu.org/archive/html/chicken-announce/2014-05/msg00001.html The patch on the discussion list is http://lists.gnu.org/archive/html/chicken-hackers/2014-05/msg00032.html and it got applied as http://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git;a=commit;h=1d06ce7e21c7e903ca5dca11fda6fcf2cc52de5e All versions of CHICKEN prior to 4.9.0 (soon to be released) and 4.8.0.7 (not yet(?) released) are affected. Cheers, Peter Bex -- http://www.more-magic.net
Current thread:
- CVE request for buffer overrun in CHICKEN Scheme Peter Bex (May 18)
- Re: CVE request for buffer overrun in CHICKEN Scheme cve-assign (May 19)