Bug 235093 (CVE-2007-2052)

Summary: CVE-2007-2052 python off-by-one locale.strxfrm() (possible memory disclosure)
Product: [Other] Security Response Reporter: Red Hat Product Security <security-response-team>
Component: vulnerabilityAssignee: James Antill <james.antill>
Status: CLOSED ERRATA QA Contact: Brock Organ <borgan>
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: kreilly, psplicha, vdanen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=416934
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-08-21 23:01:31 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 392031, 392041, 392051, 392061, 430870, 430872, 436512, 440511, 449461, 486351, 486352, 537915    
Bug Blocks: 444136    
Description Flags
Python's locale.strxfrm() off-by-one flaw PoC none

Description Lubomir Kundrak 2007-04-03 18:55:33 UTC
Description of problem:

356         n1 = strlen(s) + 1;
357         buf = PyMem_Malloc(n1);
358         if (!buf)
359             return PyErr_NoMemory();
360         n2 = strxfrm(buf, s, n1);

In case the transformed string is longer than original string...
(see the PoC for an exapmle)

361         if (n2 > n1) {
362             /* more space needed */

We allocate n2 bytes here:

363             buf = PyMem_Realloc(buf, n2);
364             if (!buf)
365                 return PyErr_NoMemory();

And here the string will be n2 chars long and terminating NUL won't
fit and thus the string won't be terminated what can lead to an
information leak in certain rare cases (see the original Debian report
for details).

366             strxfrm(buf, s, n2);
367         }
368         result = PyString_FromString(buf);
369         PyMem_Free(buf);
370         return result;
371     }
373     #if defined(MS_WINDOWS)
374     static PyObject*
375     PyLocale_getdefaultlocale(PyObject* self)

Version-Release number of selected component (if applicable):


How reproducible:

Proof of concept code attached.

Additional info:

See the URL for an original bug report to Debian and PoC by Piotr Engelking.
It contains details on how to reproduce and recognize the flaw.

Comment 1 Lubomir Kundrak 2007-04-03 18:55:33 UTC
Created attachment 151611 [details]
Python's locale.strxfrm() off-by-one flaw PoC

Comment 8 Red Hat Product Security 2008-01-16 09:00:54 UTC
This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2007-1077.html (RHEL2.1)
  http://rhn.redhat.com/errata/RHSA-2007-1076.html (RHEL3, RHEL4)

Comment 15 errata-xmlrpc 2009-07-27 09:23:29 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1176 https://rhn.redhat.com/errata/RHSA-2009-1176.html

Comment 16 Red Hat Bugzilla 2009-10-23 19:04:49 UTC
Reporter changed to security-response-team by request of Jay Turner.