full-disclosure - Re: [FD] over 2000 packages depend on abort()ing libgmp

Open Source and information security mailing list archives

Date: Thu, 13 Oct 2022 08:39:43 +0300
From: Georgi Guninski <gguninski@...il.com>
To: Matthew Fernandez <matthew.fernandez@...il.com>
Cc: fulldisclosure@...lists.org
Subject: Re: [FD] over 2000 packages depend on abort()ing libgmp

On Fri, Sep 16, 2022 at 6:44 AM Matthew Fernandez
<matthew.fernandez@...il.com> wrote:
>

>
> What is the security boundary being violated here? As a maintainer of
> some of the packages implicated here, I’m unsure what my actionable
> tasks are. The threat model(s) for my packages does not consider crashes
> to be a security violation. On the other side, things like crypto code
> frequently use their own non-GMP implementation of bignum arith for this
> (and other) reason.
>

Observe that ubuntu issue advisory about libgmp crash
without mentioning potential exploitability.

quote:
https://ubuntu.com/security/notices/USN-5672-1

Details
12 October 2022

It was discovered that GMP did not properly manage memory
on 32-bit platforms when processing a specially crafted
input. An attacker could possibly use this issue to cause
applications using GMP to crash, resulting in a denial of
service.

References
CVE-2021-43618
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives