Bug 1345856 (CVE-2016-5636)

Summary:	CVE-2016-5636 python: Heap overflow in zipimporter module
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	adev88, akurtako, alee, cstratak, derks, dmalcolm, dmoppert, hhorak, ivazqueznet, jeffrey.ness, jmatthew, jonathansteffan, jorton, katzj, kevin, lkundrak, mhroncok, pviktori, python-maint, python-sig, rkuska, rlandman, sardella, slawomir, tomspur, torsava
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was discovered in Python, in the built-in zipimporter. A specially crafted zip file placed in a module path such that it would be loaded by a later "import" statement could cause a heap overflow, leading to arbitrary code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-07-12 13:04:14 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1345857, 1345858, 1345859, 1345860, 1345861, 1356364, 1356365
Bug Blocks:	1323912, 1345863, 1811566

Description Adam Mariš 2016-06-13 10:38:12 UTC

A heap-based buffer overflow vulnerability was found in zipimporter module.

Vulnerable code:

  1116     bytes_size = compress == 0 ? data_size : data_size + 1;
  1117     if (bytes_size == 0)
  1118         bytes_size++;
  1119     raw_data = PyBytes_FromStringAndSize((char *)NULL, bytes_size);

data_size is not sanitized, so if comepress != 0 and data_size = -1, then it overflows and becomes 0. Right after then it's incremented and becomes 1. In that case, python allocates small portion of heap, which is later overflowed using fread.

Upstream bug:

https://bugs.python.org/issue26171

Upstream patches:

https://hg.python.org/cpython/rev/01ddd608b85c (3.4)
https://hg.python.org/cpython/rev/985fc64c60d6 (2.7)
https://hg.python.org/cpython/rev/10dad6da1b28 (3.5)
https://hg.python.org/cpython/rev/2df462852464 (default)


CVE request:

http://seclists.org/oss-sec/2016/q2/524

Comment 1 Adam Mariš 2016-06-13 10:39:48 UTC

Created python tracking bugs for this issue:

Affects: fedora-all [bug 1345858]

Comment 2 Adam Mariš 2016-06-13 10:39:59 UTC

Created jython tracking bugs for this issue:

Affects: fedora-all [bug 1345857]
Affects: epel-5 [bug 1345861]

Comment 3 Adam Mariš 2016-06-13 10:40:11 UTC

Created python26 tracking bugs for this issue:

Affects: epel-5 [bug 1345860]

Comment 4 Adam Mariš 2016-06-13 10:40:19 UTC

Created python3 tracking bugs for this issue:

Affects: fedora-all [bug 1345859]

Comment 5 Doran Moppert 2016-06-15 01:27:47 UTC

The patches identified in comment#0 and upstream tracker are not complete and do not prevent the attached "crash.py" reproducer.  These do:

Upstream patches:

https://hg.python.org/cpython/rev/2edbdb79cd6d (2.7)
https://hg.python.org/cpython/rev/8b58c9328f5c (3.4)
https://hg.python.org/cpython/rev/5533a9e02b21 (3.5)
https://hg.python.org/cpython/rev/0f46c9a5735f (default)

Comment 7 Andrej Nemec 2016-06-16 12:50:30 UTC

CVE assignment:

http://seclists.org/oss-sec/2016/q2/560

Comment 8 Doran Moppert 2016-07-13 07:01:07 UTC

To exploit this flaw, an attacker would need to be able to place crafted files on the python import path.  Since this already presents the opportunity for arbitrary code execution, this issue is rated as having Low security impact.

Further, the flaw is not present in either PyPy or Jython, but only in the CPython interpreter.  CPython is known to be unsuitable to create a sandbox for running untrusted user code; for this purpose either PyPy or Jython are suggested as a better fountation.

Comment 9 Doran Moppert 2016-07-13 07:28:22 UTC

Statement:

Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Comment 11 Doran Moppert 2016-07-14 02:33:44 UTC

Created python34 tracking bugs for this issue:

Affects: epel-7 [bug 1356365]

Comment 12 errata-xmlrpc 2016-11-03 20:17:01 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2586 https://rhn.redhat.com/errata/RHSA-2016-2586.html

Comment 14 Product Security DevOps Team 2019-07-12 13:04:14 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2016-5636