Bug 1345856 (CVE-2016-5636)

Summary: CVE-2016-5636 python: Heap overflow in zipimporter module
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: adev88, akurtako, alee, cstratak, derks, dmalcolm, dmoppert, hhorak, ivazqueznet, jeffrey.ness, jmatthew, jonathansteffan, jorton, katzj, kevin, lkundrak, mhroncok, pviktori, python-maint, python-sig, rkuska, rlandman, sardella, slawomir, tomspur, torsava
Target Milestone: ---Keywords: Reopened, Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was discovered in Python, in the built-in zipimporter. A specially crafted zip file placed in a module path such that it would be loaded by a later "import" statement could cause a heap overflow, leading to arbitrary code execution.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-07-12 13:04:14 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1345857, 1345858, 1345859, 1345860, 1345861, 1356364, 1356365    
Bug Blocks: 1323912, 1345863, 1811566    

Description Adam Mariš 2016-06-13 10:38:12 UTC
A heap-based buffer overflow vulnerability was found in zipimporter module.

Vulnerable code:

  1116     bytes_size = compress == 0 ? data_size : data_size + 1;
  1117     if (bytes_size == 0)
  1118         bytes_size++;
  1119     raw_data = PyBytes_FromStringAndSize((char *)NULL, bytes_size);

data_size is not sanitized, so if comepress != 0 and data_size = -1, then it overflows and becomes 0. Right after then it's incremented and becomes 1. In that case, python allocates small portion of heap, which is later overflowed using fread.

Upstream bug:


Upstream patches:

https://hg.python.org/cpython/rev/01ddd608b85c (3.4)
https://hg.python.org/cpython/rev/985fc64c60d6 (2.7)
https://hg.python.org/cpython/rev/10dad6da1b28 (3.5)
https://hg.python.org/cpython/rev/2df462852464 (default)

CVE request:


Comment 1 Adam Mariš 2016-06-13 10:39:48 UTC
Created python tracking bugs for this issue:

Affects: fedora-all [bug 1345858]

Comment 2 Adam Mariš 2016-06-13 10:39:59 UTC
Created jython tracking bugs for this issue:

Affects: fedora-all [bug 1345857]
Affects: epel-5 [bug 1345861]

Comment 3 Adam Mariš 2016-06-13 10:40:11 UTC
Created python26 tracking bugs for this issue:

Affects: epel-5 [bug 1345860]

Comment 4 Adam Mariš 2016-06-13 10:40:19 UTC
Created python3 tracking bugs for this issue:

Affects: fedora-all [bug 1345859]

Comment 5 Doran Moppert 2016-06-15 01:27:47 UTC
The patches identified in comment#0 and upstream tracker are not complete and do not prevent the attached "crash.py" reproducer.  These do:

Upstream patches:

https://hg.python.org/cpython/rev/2edbdb79cd6d (2.7)
https://hg.python.org/cpython/rev/8b58c9328f5c (3.4)
https://hg.python.org/cpython/rev/5533a9e02b21 (3.5)
https://hg.python.org/cpython/rev/0f46c9a5735f (default)

Comment 7 Andrej Nemec 2016-06-16 12:50:30 UTC
CVE assignment:


Comment 8 Doran Moppert 2016-07-13 07:01:07 UTC
To exploit this flaw, an attacker would need to be able to place crafted files on the python import path.  Since this already presents the opportunity for arbitrary code execution, this issue is rated as having Low security impact.

Further, the flaw is not present in either PyPy or Jython, but only in the CPython interpreter.  CPython is known to be unsuitable to create a sandbox for running untrusted user code; for this purpose either PyPy or Jython are suggested as a better fountation.

Comment 9 Doran Moppert 2016-07-13 07:28:22 UTC

Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Comment 11 Doran Moppert 2016-07-14 02:33:44 UTC
Created python34 tracking bugs for this issue:

Affects: epel-7 [bug 1356365]

Comment 12 errata-xmlrpc 2016-11-03 20:17:01 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2586 https://rhn.redhat.com/errata/RHSA-2016-2586.html

Comment 14 Product Security DevOps Team 2019-07-12 13:04:14 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):