Bug 1672892 (CVE-2019-1000019)

Summary:	CVE-2019-1000019 libarchive: Out of bounds read in archive_read_support_format_7zip.c resulting in a denial of service
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	besser82, bmcclain, databases-maint, dblechte, dfediuck, eedri, hhorak, mgoldboi, michal.skrivanek, mike, pkubat, praiskup, sbonazzo, sherold, yturgema
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-08-06 19:20:44 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1672900, 1672901, 1673195, 1673196, 1674057
Bug Blocks:	1672899

Description Dhananjay Arunesh 2019-02-06 06:56:55 UTC

libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards
(release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in
7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can
result in a crash (denial of service). This attack appears to be exploitable via
the victim opening a specially crafted 7zip file.

References:
https://github.com/libarchive/libarchive/pull/1120/commits/65a23f5dbee4497064e9bb467f81138a62b0dae1
https://github.com/libarchive/libarchive/pull/1120

Comment 1 Dhananjay Arunesh 2019-02-06 07:44:47 UTC

Created libarchive tracking bugs for this issue:

Affects: fedora-all [bug 1672900]

Comment 2 Dhananjay Arunesh 2019-02-06 07:45:15 UTC

Created libarchive tracking bugs for this issue:

Affects: epel-6 [bug 1672901]

Comment 3 Scott Gayou 2019-02-06 21:55:27 UTC

Simple to reproduce.

```
==7394== Use of uninitialised value of size 8
==7394==    at 0x5E2A119: crc32_z (in /usr/lib64/libz.so.1.2.11)
==7394==    by 0x4E732EE: header_bytes (archive_read_support_format_7zip.c:2809)
==7394==    by 0x4E75012: read_Header (archive_read_support_format_7zip.c:2573)
==7394==    by 0x4E75012: slurp_central_directory (archive_read_support_format_7zip.c:2926)
==7394==    by 0x4E75012: archive_read_format_7zip_read_header (archive_read_support_format_7zip.c:638)
==7394==    by 0x4E641FD: _archive_read_next_header2 (archive_read.c:648)
==7394==    by 0x4E64302: _archive_read_next_header (archive_read.c:686)
==7394==    by 0x10FC15: read_archive (read.c:260)
==7394==    by 0x11037A: tar_mode_x (read.c:112)
==7394==    by 0x10E5A0: main (bsdtar.c:864)
==7394== 
==7394== Use of uninitialised value of size 8
==7394==    at 0x5E2A127: crc32_z (in /usr/lib64/libz.so.1.2.11)
==7394==    by 0x4E732EE: header_bytes (archive_read_support_format_7zip.c:2809)
==7394==    by 0x4E75012: read_Header (archive_read_support_format_7zip.c:2573)
==7394==    by 0x4E75012: slurp_central_directory (archive_read_support_format_7zip.c:2926)
==7394==    by 0x4E75012: archive_read_format_7zip_read_header (archive_read_support_format_7zip.c:638)
==7394==    by 0x4E641FD: _archive_read_next_header2 (archive_read.c:648)
==7394==    by 0x4E64302: _archive_read_next_header (archive_read.c:686)
==7394==    by 0x10FC15: read_archive (read.c:260)
==7394==    by 0x11037A: tar_mode_x (read.c:112)
==7394==    by 0x10E5A0: main (bsdtar.c:864)
```

Looks to run off the end of a buffer in crc32_little:

```
#0  0x00007ffff6bd614f in crc32_little (len=1442449, buf=<optimized out>, crc=<optimized out>) at crc32.c:283
#1  crc32_z (crc=<optimized out>,
    buf=buf@entry=0x55555577b8a3 ";\r\231Ē\377\200\212\265\004+D\367\364\265\231Ē\377\200\212\265\004+D\367\364\265̀\314tH\241\316\372%
\347\301\016", len=len@entry=1442450) at crc32.c:220
#2  0x00007ffff6bd624b in crc32 (crc=<optimized out>,
    buf=buf@entry=0x55555577b8a3 ";\r\231Ē\377\200\212\265\004+D\367\364\265\231Ē\377\200\212\265\004+D\367\364\265̀\314tH\241\316\372%
\347\301\016", len=len@entry=1442450) at crc32.c:242
#3  0x00007ffff7b502ef in header_bytes (a=a@entry=0x55555576ccf0, rbytes=rbytes@entry=1442450)
    at libarchive/archive_read_support_format_7zip.c:2809
```

etc.

Comment 4 Scott Gayou 2019-02-06 22:02:49 UTC

Unclear when 7zip support was added, but it does not appear to be in the Red Hat Enterprise Linux 6 release, hence not vulnerable.

Comment 7 Tomas Hoger 2019-02-08 22:00:23 UTC

Created mingw-libarchive tracking bugs for this issue:

Affects: fedora-all [bug 1674057]

Comment 8 Doran Moppert 2019-02-11 00:57:12 UTC

Statement:

This vulnerability is present in the libarchive package included in Red Hat Virtualization Hypervisor, however it is never exposed to archives created by attackers or users, so the vulnerability can not be exploited.

Comment 10 errata-xmlrpc 2019-08-06 12:38:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2298 https://access.redhat.com/errata/RHSA-2019:2298

Comment 11 Product Security DevOps Team 2019-08-06 19:20:44 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-1000019

Comment 12 errata-xmlrpc 2019-11-05 22:05:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:3698 https://access.redhat.com/errata/RHSA-2019:3698