Integer overflow in sysstat - CVE-2019-16167

Vulnerability identifier: #VU30790

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-16167

CWE-ID: CWE-190

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.

sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in sa_common.c.

sysstat
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - TUS
Opensuse
Fedora
sysstat (Red Hat package)
sysstat

Install update from vendor's website.

sysstat - update to 12.1.6
sysstat (Red Hat package) - addressed in versions 11.7.3-2.el8_2.1, 11.7.3-5.el8
sysstat - update to 12.3.1-1.fc31

• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00067.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00068.html
• https://github.com/sysstat/sysstat/compare/v12.1.5...v12.1.6
• https://github.com/sysstat/sysstat/issues/230
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RVSMKUPWIGQYX4G5LZXL7ZBJN3KY6RM3/
• https://usn.ubuntu.com/4242-1/

• Integer overflow in sysstat
• OpenSUSE Linux update for sysstat
• OpenSUSE Linux update for sysstat
• Red Hat Enterprise Linux 8 update for sysstat
• Red Hat Enterprise Linux 8.2 update for sysstat
• Fedora 31 update for sysstat