Merge ~rodrigo-zaiden/ubuntu-cve-tracker:feature/triage-cve-icu into ubuntu-cve-tracker:master

[Rodrigo Figueiredo Zaiden]

CVE-2021-30535: icu: triage update

code that caused the issue was added in 66.1
so, bionic/xenial/trusty is not affected

hi there, would you, please, help to review this?

I'm proposing to change bionic/xenial/trusty to
code-not-affect because from my analysis, the vuln
was inserted in release 66.1, mainly in the following
commit:
https://github.com/unicode-org/icu/commit/596647c0

From my analysis, the double free is triggered from
the setKeywordValue method when:

  // if full Name is already on the heap, need to free it.
  uprv_free(fullName);

after this free, if baseName shares same address as fullName
it should be re-assigned before freed.
for reference, the fix is in the commit:
https://github.com/unicode-org/icu/commit/e450fa50

so, as the commit 596647c0 is not present in releases
prior to 66.1, those releases would not be affected.

additional comments:
- I have tried to backport only the unit test from commit
e450fa50 to validate releases before 66.1 but it was not
possible due to the many different ways code has evolved
over time (should I put more effort in this?)

- The commit that I'm blaming (596647c0) does a bug fix,
and it seems hard to decide whether it should be added
and fixed. My opinion is that by reading the ticket,
not adding the bugfix is betther than adding the bug
+ the security fix, can someone please check if my thoughts
are correct?
the bug being fixed and causing the vuln:
  https://unicode-org.atlassian.net/browse/ICU-20862

any other idea and approaches to this analyses are appreciated.
besides the analyses, please let me know if the comments are
appropriated.

thanks a lot,
Rodrigo

[Seth Arnold (seth-arnold)]

Your analysis looks right to me; I gave a quick look in icu_52.1-3ubuntu0.8 to pick a random old version that we shipped and double-checked that uloc_setKeywordValue() was prepared to return U_BUFFER_OVERFLOW_ERROR on over-long inputs, to make sure that wasn't a recent addition, too.

I think your note about "introduced in" would be nice to have directly in the CVE file itself -- that way it'd be exposed in the web interface. Our commit messages aren't usually useful / interesting enough to look through them in any real detail when solving problems.

Thanks

78dc2be... by Rodrigo Figueiredo Zaiden on 2021-10-22

    CVE-2021-30535: icu: triage update

    code that caused the issue was added from 66.1
    bionic/xenial/trusty is not affected.
    adding more info the notes

[Rodrigo Figueiredo Zaiden (rodrigo-zaiden)]

> Your analysis looks right to me; I gave a quick look in icu_52.1-3ubuntu0.8 to
> pick a random old version that we shipped and double-checked that
> uloc_setKeywordValue() was prepared to return U_BUFFER_OVERFLOW_ERROR on over-
> long inputs, to make sure that wasn't a recent addition, too.
>
> I think your note about "introduced in" would be nice to have directly in the
> CVE file itself -- that way it'd be exposed in the web interface. Our commit
> messages aren't usually useful / interesting enough to look through them in
> any real detail when solving problems.
>
> Thanks

hi Seth,

thanks a lot for your review.
I update the notes with more information, it does make sense.

would you, please, verify if they are appropriated?

thanks!

[Seth Arnold (seth-arnold)]

Looks good to me :) thanks!

review: Approve

diff --git a/active/CVE-2021-30535 b/active/CVE-2021-30535
index c6e0e39..b590204 100644
--- a/active/CVE-2021-30535
+++ b/active/CVE-2021-30535
@@ -12,6 +12,9 @@ Notes:
   Ubuntu
  mdeslaur> starting with Ubuntu 19.10, the chromium-browser package is just
   a script that installs the Chromium snap
+ rodrigo-zaiden> ICU issue was introduced in commit 
+  https://github.com/unicode-org/icu/commit/596647c0, released in version
+  66.1. So, trusty, xenial and bionic are not affected
 Mitigation: 
 Bugs: 
  https://bugs.chromium.org/p/chromium/issues/detail?id=1194899
@@ -37,10 +40,10 @@ Patches_icu:
  upstream: https://github.com/unicode-org/icu/commit/e450fa50fc242282551f56b941dc93b9a8a0bcbb
 upstream_icu: released (70-rc)
 trusty_icu: ignored (out of standard support)
-trusty/esm_icu: needed
+trusty/esm_icu: not-affected (code not present)
 xenial_icu: ignored (out of standard support)
-esm-infra/xenial_icu: needed
-bionic_icu: needed
+esm-infra/xenial_icu: not-affected (code not present)
+bionic_icu: not-affected (code not present)
 focal_icu: needed
 hirsute_icu: needed
 impish_icu: not-affected (67.1-7ubuntu1)