Re: [FD] over 2000 packages depend on abort()ing libgmp

[Georgi Guninski <gguninski@xxxxxxxxx>]

On Fri, Sep 16, 2022 at 6:44 AM Matthew Fernandez
<matthew.fernandez@xxxxxxxxx> wrote:
>

>
> What is the security boundary being violated here? As a maintainer of
> some of the packages implicated here, I’m unsure what my actionable
> tasks are. The threat model(s) for my packages does not consider crashes
> to be a security violation. On the other side, things like crypto code
> frequently use their own non-GMP implementation of bignum arith for this
> (and other) reason.
>

Observe that ubuntu issue advisory about libgmp crash
without mentioning potential exploitability.

quote:
https://ubuntu.com/security/notices/USN-5672-1

Details
12 October 2022

It was discovered that GMP did not properly manage memory
on 32-bit platforms when processing a specially crafted
input. An attacker could possibly use this issue to cause
applications using GMP to crash, resulting in a denial of
service.

References
CVE-2021-43618
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/