oss-sec mailing list archives
CVE request: screen stack overflow (deep recursion)
From: Florian Weimer <fw () deneb enyo de>
Date: Tue, 01 Sep 2015 07:20:56 +0200
Upstream bug report by Kuang-che Wu: “ How to reproduce: Run this command inside screen $ printf '\x1b[10000000T' screen will recursively call MScrollV to depth n/256. This is time consuming and will overflow stack if n is huge. ” <https://savannah.gnu.org/bugs/?45713> Upstream fix: http://git.savannah.gnu.org/cgit/screen.git/commit/?id=b7484c224738247b510ed0d268cd577076958f1b Debian bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=797624 MScrollV creates a very large stack frame, so it could theoreticall jump over the guard page at the top of the stack, and it might be feasible to exploit this for something else besides denial-of-service.
Current thread:
- CVE request: screen stack overflow (deep recursion) Florian Weimer (Aug 31)
- Re: CVE request: screen stack overflow (deep recursion) cve-assign (Sep 02)
- AW: Re: CVE request: screen stack overflow (deep recursion) Fiedler Roman (Sep 02)
- Re: CVE request: screen stack overflow (deep recursion) Solar Designer (Sep 02)
- Re: CVE request: screen stack overflow (deep recursion) Solar Designer (Sep 03)
- Re: CVE request: screen stack overflow (deep recursion) Kuang-che Wu (Sep 03)
- AW: Re: CVE request: screen stack overflow (deep recursion) Fiedler Roman (Sep 02)
- Re: CVE request: screen stack overflow (deep recursion) cve-assign (Sep 02)