On Fri, Sep 16, 2022 at 6:44 AM Matthew Fernandez <matthew.fernan...@gmail.com> wrote: >
> > What is the security boundary being violated here? As a maintainer of > some of the packages implicated here, I’m unsure what my actionable > tasks are. The threat model(s) for my packages does not consider crashes > to be a security violation. On the other side, things like crypto code > frequently use their own non-GMP implementation of bignum arith for this > (and other) reason. > Observe that ubuntu issue advisory about libgmp crash without mentioning potential exploitability. quote: https://ubuntu.com/security/notices/USN-5672-1 Details 12 October 2022 It was discovered that GMP did not properly manage memory on 32-bit platforms when processing a specially crafted input. An attacker could possibly use this issue to cause applications using GMP to crash, resulting in a denial of service. References CVE-2021-43618 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
