CVE-2023-32636

A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.

A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.

A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.

Security Fix(es):

• glib: GVariant offset table entry size is not checked in is_normal() (CVE-2023-29499)
• glib: g_variant_byteswap() can take a long time with some non-normal inputs (CVE-2023-32611)
• glib: Timeout in fuzz_variant_text (CVE-2023-32636)
• glib: GVariant deserialisation does not match spec for non-normal data (CVE-2023-32665)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2023-29499: Fix GVariant offset table entry size which is not checked in is_normal()
• CVE-2023-32611: Fix an issue where g_variant_byteswap() can take a long time with some non-normal inputs
• CVE-2023-32665: Fix GVariant deserialisation which does not match spec for non-normal data
• CVE-2023-32636: Fix a wrong timeout in fuzz_variant_text()
• CVE-2023-32643: Fix a heap-buffer-overflow in g_variant_serialised_get_child()
• Fix g_test_bug assertion in gvariant test

• Enable internal tests
• Skip several failed tests from the check
• CVE-2023-29499: Fix GVariant offset table entry size which is not checked in is_normal()
• CVE-2023-32611: Fix an issue where g_variant_byteswap() can take a long time with some non-normal inputs
• CVE-2023-32665: Fix GVariant deserialisation which does not match spec for non-normal data
• CVE-2023-32636: Fix a wrong timeout in fuzz_variant_text()
• CVE-2023-32643: Fix a heap-buffer-overflow in g_variant_serialised_get_child()
• Fix g_test_bug assertion in gvariant test

• Enable internal tests
• Skip several failed tests from the check
• CVE-2023-29499: Fix GVariant offset table entry size which is not checked in is_normal()
• CVE-2023-32611: Fix an issue where g_variant_byteswap() can take a long time with some non-normal inputs
• CVE-2023-32665: Fix GVariant deserialisation which does not match spec for non-normal data
• CVE-2023-32636: Fix a wrong timeout in fuzz_variant_text()
• CVE-2023-32643: Fix a heap-buffer-overflow in g_variant_serialised_get_child()
• Fix g_test_bug assertion in gvariant test

• SECURITY UPDATE: GVariant security issues
  • debian/patches/CVE-2023-29499-x-CVE-2023-32665/*.patch: fix multiple GVariant serialization issues
  • CVE-2023-29499, CVE-2023-32611, CVE-2023-32636, CVE-2023-32643, CVE-2023-32665
• debian/patches/fix-g_test_bug-assertion.patch: Fix g_test_bug assertion in gvariant test
• debian/patches/libglib2.0-0.symbols: Add new symbols

• SECURITY UPDATE: GVariant security issues
  • debian/patches/CVE-2023-29499-x-CVE-2023-32665/*.patch: fix multiple GVariant serialization issues
  • CVE-2023-29499, CVE-2023-32611, CVE-2023-32636, CVE-2023-32643, CVE-2023-32665
• debian/patches/fix-g_test_bug-assertion.patch: Fix g_test_bug assertion in gvariant test
• debian/patches/skip-several-failed-tests.patch: Skip several failed tests
• debian/patches/libglib2.0-0.symbols: Add new symbol

• CVE-2023-29499: fix GVariant offset table entry size which is not checked in is_normal().
• CVE-2023-32636: remediate GVariant deserialisation timeout regression introduced by the CVE-2023-29499 fix.
• Backported upstream MR 3126 (22 commits) from centos8.5els.

This update for glib2 fixes the following issues:

• CVE-2021-28153: Fixed an issue where symlink targets would be incorrectly created as empty files. (bsc#1183533)
• CVE-2023-32665: Fixed GVariant deserialisation which does not match spec for non-normal data. (bsc#1211945)
• CVE-2023-32643: Fixed a heap-buffer-overflow in g_variant_serialised_get_child(). (bsc#1211946)
• CVE-2023-29499: Fixed GVariant offset table entry size which is not checked in is_normal(). (bsc#1211947)
• CVE-2023-32636: Fixed a wrong timeout in fuzz_variant_text(). (bsc#1211948)
• CVE-2023-32611: Fixed an issue where g_variant_byteswap() can take a long time with some non-normal inputs. (bsc#1211951)

It was discovered that GLib incorrectly handled non-normal GVariants. An attacker could use this issue to cause GLib to crash, resulting in a denial of service, or perform other unknown attacks.

USN-6165-1 fixed vulnerabilities in GLib. This update provides the corresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

It was discovered that GLib incorrectly handled non-normal GVariants. An attacker could use this issue to cause GLib to crash, resulting in a denial of service, or perform other unknown attacks.