Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Garbage_collector | Boehm-demers-weiser | * | 7.2 (including) |
| Garbage_collector | Boehm-demers-weiser | 1.3 (including) | 1.3 (including) |
| Garbage_collector | Boehm-demers-weiser | 1.4 (including) | 1.4 (including) |
| Garbage_collector | Boehm-demers-weiser | 1.5 (including) | 1.5 (including) |
| Garbage_collector | Boehm-demers-weiser | 1.8 (including) | 1.8 (including) |
| Garbage_collector | Boehm-demers-weiser | 1.9 (including) | 1.9 (including) |
| Garbage_collector | Boehm-demers-weiser | 2.0 (including) | 2.0 (including) |
| Garbage_collector | Boehm-demers-weiser | 2.1 (including) | 2.1 (including) |
| Garbage_collector | Boehm-demers-weiser | 2.2 (including) | 2.2 (including) |
| Garbage_collector | Boehm-demers-weiser | 2.3 (including) | 2.3 (including) |
| Garbage_collector | Boehm-demers-weiser | 2.4 (including) | 2.4 (including) |
| Garbage_collector | Boehm-demers-weiser | 3.0 (including) | 3.0 (including) |
| Garbage_collector | Boehm-demers-weiser | 3.1 (including) | 3.1 (including) |
| Garbage_collector | Boehm-demers-weiser | 3.2 (including) | 3.2 (including) |
| Garbage_collector | Boehm-demers-weiser | 3.3 (including) | 3.3 (including) |
| Garbage_collector | Boehm-demers-weiser | 3.4 (including) | 3.4 (including) |
| Garbage_collector | Boehm-demers-weiser | 3.5 (including) | 3.5 (including) |
| Garbage_collector | Boehm-demers-weiser | 3.6 (including) | 3.6 (including) |
| Garbage_collector | Boehm-demers-weiser | 3.7 (including) | 3.7 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.0 (including) | 4.0 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.1 (including) | 4.1 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.2 (including) | 4.2 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.3 (including) | 4.3 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.4 (including) | 4.4 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.5 (including) | 4.5 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.6 (including) | 4.6 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.7 (including) | 4.7 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.8 (including) | 4.8 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.9 (including) | 4.9 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.10 (including) | 4.10 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.11 (including) | 4.11 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.12 (including) | 4.12 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.13 (including) | 4.13 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.14 (including) | 4.14 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.14-alpha1 (including) | 4.14-alpha1 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.14-alpha2 (including) | 4.14-alpha2 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.0 (including) | 5.0 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.0-alpha1 (including) | 5.0-alpha1 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.0-alpha2 (including) | 5.0-alpha2 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.0-alpha3 (including) | 5.0-alpha3 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.0-alpha4 (including) | 5.0-alpha4 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.0-alpha6 (including) | 5.0-alpha6 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.0-alpha7 (including) | 5.0-alpha7 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.1 (including) | 5.1 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.2 (including) | 5.2 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.3 (including) | 5.3 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.4 (including) | 5.4 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0 (including) | 6.0 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0-alpha1 (including) | 6.0-alpha1 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0-alpha2 (including) | 6.0-alpha2 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0-alpha3 (including) | 6.0-alpha3 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0-alpha4 (including) | 6.0-alpha4 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0-alpha5 (including) | 6.0-alpha5 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0-alpha6 (including) | 6.0-alpha6 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0-alpha7 (including) | 6.0-alpha7 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0-alpha8 (including) | 6.0-alpha8 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0-alpha9 (including) | 6.0-alpha9 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.1 (including) | 6.1 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.1-alpha1 (including) | 6.1-alpha1 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.1-alpha2 (including) | 6.1-alpha2 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.1-alpha3 (including) | 6.1-alpha3 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.1-alpha4 (including) | 6.1-alpha4 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.1-alpha5 (including) | 6.1-alpha5 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.2 (including) | 6.2 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.2-alpha1 (including) | 6.2-alpha1 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.2-alpha2 (including) | 6.2-alpha2 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.2-alpha3 (including) | 6.2-alpha3 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.2-alpha4 (including) | 6.2-alpha4 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.2-alpha5 (including) | 6.2-alpha5 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.2-alpha6 (including) | 6.2-alpha6 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.3 (including) | 6.3 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.3-alpha1 (including) | 6.3-alpha1 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.3-alpha2 (including) | 6.3-alpha2 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.3-alpha3 (including) | 6.3-alpha3 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.3-alpha4 (including) | 6.3-alpha4 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.3-alpha5 (including) | 6.3-alpha5 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.3-alpha6 (including) | 6.3-alpha6 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.4 (including) | 6.4 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.5 (including) | 6.5 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.6 (including) | 6.6 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.7 (including) | 6.7 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.8 (including) | 6.8 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.9 (including) | 6.9 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.0 (including) | 7.0 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.0-alpha1 (including) | 7.0-alpha1 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.0-alpha2 (including) | 7.0-alpha2 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.0-alpha3 (including) | 7.0-alpha3 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.0-alpha4 (including) | 7.0-alpha4 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.0-alpha5 (including) | 7.0-alpha5 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.0-alpha7 (including) | 7.0-alpha7 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.0-alpha9 (including) | 7.0-alpha9 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.1 (including) | 7.1 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.1-alpha2 (including) | 7.1-alpha2 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.2-alpha2 (including) | 7.2-alpha2 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.2-alpha4 (including) | 7.2-alpha4 (including) |
| Red Hat Enterprise Linux 6 | RedHat | gc-0:7.1-12.el6_4 | * |
| Red Hat Satellite 5.6 | RedHat | gc-0:7.1-12.2.el5sat | * |
| Red Hat Satellite Proxy v 5.6 | RedHat | gc-0:7.1-12.2.el5sat | * |
| Libgc | Ubuntu | devel | * |
| Libgc | Ubuntu | hardy | * |
| Libgc | Ubuntu | lucid | * |
| Libgc | Ubuntu | natty | * |
| Libgc | Ubuntu | oneiric | * |
| Libgc | Ubuntu | precise | * |
References
- http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited/
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082926.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082988.html
- http://rhn.redhat.com/errata/RHSA-2013-1500.html
- http://rhn.redhat.com/errata/RHSA-2014-0149.html
- http://rhn.redhat.com/errata/RHSA-2014-0150.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:158
- http://www.openwall.com/lists/oss-security/2012/06/05/1
- http://www.openwall.com/lists/oss-security/2012/06/07/13
- http://www.securityfocus.com/bid/54227
- http://www.ubuntu.com/usn/USN-1546-1
- https://github.com/ivmai/bdwgc/blob/master/ChangeLog
- https://github.com/ivmai/bdwgc/commit/6a93f8e5bcad22137f41b6c60a1c7384baaec2b3
- https://github.com/ivmai/bdwgc/commit/83231d0ab5ed60015797c3d1ad9056295ac3b2bb
- https://github.com/ivmai/bdwgc/commit/be9df82919960214ee4b9d3313523bff44fd99e1
- https://github.com/ivmai/bdwgc/commit/e10c1eb9908c2774c16b3148b30d2f3823d66a9a
- http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited/
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082926.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082988.html
- http://rhn.redhat.com/errata/RHSA-2013-1500.html
- http://rhn.redhat.com/errata/RHSA-2014-0149.html
- http://rhn.redhat.com/errata/RHSA-2014-0150.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:158
- http://www.openwall.com/lists/oss-security/2012/06/05/1
- http://www.openwall.com/lists/oss-security/2012/06/07/13
- http://www.securityfocus.com/bid/54227
- http://www.ubuntu.com/usn/USN-1546-1
- https://github.com/ivmai/bdwgc/blob/master/ChangeLog
- https://github.com/ivmai/bdwgc/commit/6a93f8e5bcad22137f41b6c60a1c7384baaec2b3
- https://github.com/ivmai/bdwgc/commit/83231d0ab5ed60015797c3d1ad9056295ac3b2bb
- https://github.com/ivmai/bdwgc/commit/be9df82919960214ee4b9d3313523bff44fd99e1
- https://github.com/ivmai/bdwgc/commit/e10c1eb9908c2774c16b3148b30d2f3823d66a9a