Bug 1345856 (CVE-2016-5636) - CVE-2016-5636 python: Heap overflow in zipimporter module
Summary: CVE-2016-5636 python: Heap overflow in zipimporter module
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-5636
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1345857 1345858 1345859 1345860 1345861 1356364 1356365
Blocks: 1323912 1345863 1811566
TreeView+ depends on / blocked
 
Reported: 2016-06-13 10:38 UTC by Adam Mariš
Modified: 2021-02-17 03:44 UTC (History)
26 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was discovered in Python, in the built-in zipimporter. A specially crafted zip file placed in a module path such that it would be loaded by a later "import" statement could cause a heap overflow, leading to arbitrary code execution.
Clone Of:
Environment:
Last Closed: 2019-07-12 13:04:14 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2586 0 normal SHIPPED_LIVE Low: python security, bug fix, and enhancement update 2016-11-03 12:09:15 UTC

Description Adam Mariš 2016-06-13 10:38:12 UTC 
A heap-based buffer overflow vulnerability was found in zipimporter module.

Vulnerable code:

  1116     bytes_size = compress == 0 ? data_size : data_size + 1;
  1117     if (bytes_size == 0)
  1118         bytes_size++;
  1119     raw_data = PyBytes_FromStringAndSize((char *)NULL, bytes_size);

data_size is not sanitized, so if comepress != 0 and data_size = -1, then it overflows and becomes 0. Right after then it's incremented and becomes 1. In that case, python allocates small portion of heap, which is later overflowed using fread.

Upstream bug:

https://bugs.python.org/issue26171

Upstream patches:

https://hg.python.org/cpython/rev/01ddd608b85c (3.4)
https://hg.python.org/cpython/rev/985fc64c60d6 (2.7)
https://hg.python.org/cpython/rev/10dad6da1b28 (3.5)
https://hg.python.org/cpython/rev/2df462852464 (default)


CVE request:

http://seclists.org/oss-sec/2016/q2/524
Comment 1 Adam Mariš 2016-06-13 10:39:48 UTC 
Created python tracking bugs for this issue:

Affects: fedora-all [bug 1345858]
Comment 2 Adam Mariš 2016-06-13 10:39:59 UTC 
Created jython tracking bugs for this issue:

Affects: fedora-all [bug 1345857]
Affects: epel-5 [bug 1345861]
Comment 3 Adam Mariš 2016-06-13 10:40:11 UTC 
Created python26 tracking bugs for this issue:

Affects: epel-5 [bug 1345860]
Comment 4 Adam Mariš 2016-06-13 10:40:19 UTC 
Created python3 tracking bugs for this issue:

Affects: fedora-all [bug 1345859]
Comment 5 Doran Moppert 2016-06-15 01:27:47 UTC 
The patches identified in comment#0 and upstream tracker are not complete and do not prevent the attached "crash.py" reproducer.  These do:

Upstream patches:

https://hg.python.org/cpython/rev/2edbdb79cd6d (2.7)
https://hg.python.org/cpython/rev/8b58c9328f5c (3.4)
https://hg.python.org/cpython/rev/5533a9e02b21 (3.5)
https://hg.python.org/cpython/rev/0f46c9a5735f (default)
Comment 7 Andrej Nemec 2016-06-16 12:50:30 UTC 
CVE assignment:

http://seclists.org/oss-sec/2016/q2/560
Comment 8 Doran Moppert 2016-07-13 07:01:07 UTC 
To exploit this flaw, an attacker would need to be able to place crafted files on the python import path.  Since this already presents the opportunity for arbitrary code execution, this issue is rated as having Low security impact.

Further, the flaw is not present in either PyPy or Jython, but only in the CPython interpreter.  CPython is known to be unsuitable to create a sandbox for running untrusted user code; for this purpose either PyPy or Jython are suggested as a better fountation.
Comment 9 Doran Moppert 2016-07-13 07:28:22 UTC 
Statement:

Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Comment 11 Doran Moppert 2016-07-14 02:33:44 UTC 
Created python34 tracking bugs for this issue:

Affects: epel-7 [bug 1356365]
Comment 12 errata-xmlrpc 2016-11-03 20:17:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2586 https://rhn.redhat.com/errata/RHSA-2016-2586.html
Comment 14 Product Security DevOps Team 2019-07-12 13:04:14 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2016-5636
Note You need to log in before you can comment on or make changes to this bug.