Bug 1672892 (CVE-2019-1000019) - CVE-2019-1000019 libarchive: Out of bounds read in archive_read_support_format_7zip.c resulting in a denial of service
Summary: CVE-2019-1000019 libarchive: Out of bounds read in archive_read_support_forma...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-1000019
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1672901 1672900 1673195 1673196 1674057
Blocks: 1672899
TreeView+ depends on / blocked
 
Reported: 2019-02-06 06:56 UTC by Dhananjay Arunesh
Modified: 2019-11-05 22:05 UTC (History)
15 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-08-06 19:20:44 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:2298 None None None 2019-08-06 12:38:31 UTC
Red Hat Product Errata RHSA-2019:3698 None None None 2019-11-05 22:05:34 UTC

Description Dhananjay Arunesh 2019-02-06 06:56:55 UTC
libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards
(release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in
7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can
result in a crash (denial of service). This attack appears to be exploitable via
the victim opening a specially crafted 7zip file.

References:
https://github.com/libarchive/libarchive/pull/1120/commits/65a23f5dbee4497064e9bb467f81138a62b0dae1
https://github.com/libarchive/libarchive/pull/1120

Comment 1 Dhananjay Arunesh 2019-02-06 07:44:47 UTC
Created libarchive tracking bugs for this issue:

Affects: fedora-all [bug 1672900]

Comment 2 Dhananjay Arunesh 2019-02-06 07:45:15 UTC
Created libarchive tracking bugs for this issue:

Affects: epel-6 [bug 1672901]

Comment 3 Scott Gayou 2019-02-06 21:55:27 UTC
Simple to reproduce.

```
==7394== Use of uninitialised value of size 8
==7394==    at 0x5E2A119: crc32_z (in /usr/lib64/libz.so.1.2.11)
==7394==    by 0x4E732EE: header_bytes (archive_read_support_format_7zip.c:2809)
==7394==    by 0x4E75012: read_Header (archive_read_support_format_7zip.c:2573)
==7394==    by 0x4E75012: slurp_central_directory (archive_read_support_format_7zip.c:2926)
==7394==    by 0x4E75012: archive_read_format_7zip_read_header (archive_read_support_format_7zip.c:638)
==7394==    by 0x4E641FD: _archive_read_next_header2 (archive_read.c:648)
==7394==    by 0x4E64302: _archive_read_next_header (archive_read.c:686)
==7394==    by 0x10FC15: read_archive (read.c:260)
==7394==    by 0x11037A: tar_mode_x (read.c:112)
==7394==    by 0x10E5A0: main (bsdtar.c:864)
==7394== 
==7394== Use of uninitialised value of size 8
==7394==    at 0x5E2A127: crc32_z (in /usr/lib64/libz.so.1.2.11)
==7394==    by 0x4E732EE: header_bytes (archive_read_support_format_7zip.c:2809)
==7394==    by 0x4E75012: read_Header (archive_read_support_format_7zip.c:2573)
==7394==    by 0x4E75012: slurp_central_directory (archive_read_support_format_7zip.c:2926)
==7394==    by 0x4E75012: archive_read_format_7zip_read_header (archive_read_support_format_7zip.c:638)
==7394==    by 0x4E641FD: _archive_read_next_header2 (archive_read.c:648)
==7394==    by 0x4E64302: _archive_read_next_header (archive_read.c:686)
==7394==    by 0x10FC15: read_archive (read.c:260)
==7394==    by 0x11037A: tar_mode_x (read.c:112)
==7394==    by 0x10E5A0: main (bsdtar.c:864)
```

Looks to run off the end of a buffer in crc32_little:

```
#0  0x00007ffff6bd614f in crc32_little (len=1442449, buf=<optimized out>, crc=<optimized out>) at crc32.c:283
#1  crc32_z (crc=<optimized out>,
    buf=buf@entry=0x55555577b8a3 ";\r\231Ē\377\200\212\265\004+D\367\364\265\231Ē\377\200\212\265\004+D\367\364\265̀\314tH\241\316\372%
\347\301\016", len=len@entry=1442450) at crc32.c:220
#2  0x00007ffff6bd624b in crc32 (crc=<optimized out>,
    buf=buf@entry=0x55555577b8a3 ";\r\231Ē\377\200\212\265\004+D\367\364\265\231Ē\377\200\212\265\004+D\367\364\265̀\314tH\241\316\372%
\347\301\016", len=len@entry=1442450) at crc32.c:242
#3  0x00007ffff7b502ef in header_bytes (a=a@entry=0x55555576ccf0, rbytes=rbytes@entry=1442450)
    at libarchive/archive_read_support_format_7zip.c:2809
```

etc.

Comment 4 Scott Gayou 2019-02-06 22:02:49 UTC
Unclear when 7zip support was added, but it does not appear to be in the Red Hat Enterprise Linux 6 release, hence not vulnerable.

Comment 7 Tomas Hoger 2019-02-08 22:00:23 UTC
Created mingw-libarchive tracking bugs for this issue:

Affects: fedora-all [bug 1674057]

Comment 8 Doran Moppert 2019-02-11 00:57:12 UTC
Statement:

This vulnerability is present in the libarchive package included in Red Hat Virtualization Hypervisor, however it is never exposed to archives created by attackers or users, so the vulnerability can not be exploited.

Comment 10 errata-xmlrpc 2019-08-06 12:38:30 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2298 https://access.redhat.com/errata/RHSA-2019:2298

Comment 11 Product Security DevOps Team 2019-08-06 19:20:44 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-1000019

Comment 12 errata-xmlrpc 2019-11-05 22:05:32 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:3698 https://access.redhat.com/errata/RHSA-2019:3698


Note You need to log in before you can comment on or make changes to this bug.