CVE-2018-14618:NTLM buffer overflow via integer overflow

[zhao.shuai]

Brief Description
-----------------
curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)

Severity
--------
Major: System/Feature is usable but degraded

Steps to Reproduce
------------------
Affected versions: libcurl 7.36.0 to and including 7.56.1
Not affected versions: libcurl < 7.36.0 and >= 7.57.0

Detailed description path
------------------
https://nvd.nist.gov/vuln/detail/CVE-2018-14618
https://curl.haxx.se/docs/CVE-2017-8816.html

[Ghada Khalil (gkhalil)]

This meets the CVE policy for providing a fix to stx.2.0 as well as master.

[Long.Li (long.li)]

we are investigating on it,
if make any progress,
we will update on launchpad.

[Long.Li (long.li)]

As we investigate,
currently libcurl version of starlingx is libcurl-7.29.0-51.el7.x86_64.rpm.
since curl before version 7.61.1 is vulnerable to a buffer overrun. (we are in the scope of vulnerable)
so we should update version to 7.61.1 or more.

but when we search from upstream where url: https://rpmfind.net/linux/rpm2html/search.php?query=libcurl&submit=Search+...&system=centos&arch=x86_64
we find curl version for centos, libcurl-7.29.0-51.el7.x86_64.rpm is already the latest version.
so we don't own upstream rpm package for starlingx to upgrade.

shall we build latest libcurl rpm with source tarball by ourself,
or we not update curl version until upstream curl upgrade latest version.
or every guys have any suggestions, please let me know.

<email address hidden>

[Lin Shuicheng (shuicheng)]

Per link https://access.redhat.com/errata/RHSA-2019:1880
This issue is fixed in libcurl-7.29.0-51.el7_6.3.x86_64.rpm for RHEL/CentOS.

[Long.Li (long.li)]

we have modified code and compiled to bootimage.iso

and currently we are proceeding to deploy test.

[Cindy Xie (xxie1)]

can you please upload the patch so that we can review it before you do more testing?

[Long.Li (long.li)]

I have upload the patch for this issue.

https://review.opendev.org/#/c/678980

please help review. thanks!

[Long.Li (long.li)]

we have test deploy and test basic function.
use curl command to test http access.
launch cirros instance and run.
all test case have been passed.

[Cindy Xie (xxie1)]

patch https://review.opendev.org/#/c/678980 has been merged to master. Please cherry pick to stx.2.0 after the branch is open. Mark it as "fix released" for now.

[Ghada Khalil (gkhalil)]

Change is merged in r/stx.2.0:
https://review.opendev.org/#/c/682202/