1797336 - (CVE-2022-43680) Evaluate expat CVE-2022-43680 fix

Status: RESOLVED FIXED

(Core :: XML, defect)

Description

[(PTO June 19-July 7) Ryan VanderMeulen]

The new expat 2.5.0 release shipped today included a CVE fix:

#616 #649 #650 CVE-2022-43680 -- Fix heap use-after-free after overeager destruction of a shared DTD in function XML_ExternalEntityParserCreate in out-of-memory situations. Expected impact is denial of service or potentially arbitrary code execution.

https://github.com/libexpat/libexpat/pull/650/files

While RLBox sandboxing potentially mitigates the severity of this issue for our official releases, we should be cognizant of distros which ship with RLBox disabled where the severity may be higher when determining which course of action to take.

Comment 1

[Peter Van der Beken [:peterv]]

I think we will need to patch.

Comment 2

[Peter Van der Beken [:peterv]]

Attachment: Bug 1797336 - Apply expat CVE-2022-43680 fix. r?mccr8!

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/17e2d3feebca
Apply expat CVE-2022-43680 fix. r=mccr8

Comment 4

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/17e2d3feebca

Comment 5

[(PTO June 19-July 7) Ryan VanderMeulen]

Please nominate this for Beta and ESR102 approval when you get a chance, Peter.

Comment 6

[Peter Van der Beken [:peterv]]

Comment on attachment 9300841 [details]
Bug 1797336 - Apply expat CVE-2022-43680 fix. r?mccr8!

Beta/Release Uplift Approval Request

• User impact if declined: Security issue (UAF).
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Code only runs when running out of memory.
• String changes made/needed:
• Is Android affected?: Yes

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Fix for a security issue not marked as such (imported from upstream). We're probably not vulnerable because of RLBox, but some distros ship witout RLBox.
• User impact if declined: Security issue (UAF).
• Fix Landed on Version: 108
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Code only runs when running out of memory.

Comment 7

[Donal Meehan [:dmeehan]]

Comment on attachment 9300841 [details]
Bug 1797336 - Apply expat CVE-2022-43680 fix. r?mccr8!

Approved for 107.0b9

Comment 8

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-beta/rev/c1c663fb93e2

Comment 9

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-esr102/rev/b8cf39722afa

Comment 10

[Donal Meehan [:dmeehan]]

Comment on attachment 9300841 [details]
Bug 1797336 - Apply expat CVE-2022-43680 fix. r?mccr8!

Approved for 102.5esr.