Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[CVE-2019-20907] Infinite loop in the tarfile module #83198

Closed
jvoisin mannequin opened this issue Dec 10, 2019 · 17 comments
Closed

[CVE-2019-20907] Infinite loop in the tarfile module #83198

jvoisin mannequin opened this issue Dec 10, 2019 · 17 comments
Labels
3.7 (EOL) end of life 3.8 only security fixes 3.9 only security fixes 3.10 only security fixes type-security A security issue

Comments

@jvoisin
Copy link
Mannequin

jvoisin mannequin commented Dec 10, 2019

BPO 39017
Nosy @gustaebel, @larryhastings, @ned-deily, @encukou, @ethanfurman, @mgorny, @serhiy-storchaka, @miss-islington, @bcaller, @rishi93
PRs
  • bpo-39017 Fix infinite loop in the tarfile module #21454
  • [3.9] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) #21482
  • [3.8] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) #21483
  • [3.7] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) #21484
  • [3.6] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) #21485
  • [3.5] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) #21489
    		•
    Files
  • timeout-a52710a313fdb35fb428c3399277cb640fe2f686: Infinite loop reproducer.
  • recursion.tar: Minimal infinite loop reproducer
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2020-07-16.19:49:38.415>
created_at = <Date 2019-12-10.16:19:56.633>
labels = ['type-security', '3.7', '3.8', '3.9', '3.10']
title = '[CVE-2019-20907] Infinite loop in the tarfile module'
updated_at = <Date 2020-08-03.10:07:01.350>
user = 'https://bugs.python.org/jvoisin'

    bugs.python.org fields:

    activity = <Date 2020-08-03.10:07:01.350>
actor = 'vstinner'
assignee = 'none'
closed = True
closed_date = <Date 2020-07-16.19:49:38.415>
closer = 'larry'
components = []
creation = <Date 2019-12-10.16:19:56.633>
creator = 'jvoisin'
dependencies = []
files = ['48768', '49309']
hgrepos = []
issue_num = 39017
keywords = ['patch']
message_count = 17.0
messages = ['358200', '373339', '373341', '373468', '373473', '373577', '373632', '373681', '373683', '373684', '373685', '373686', '373687', '373688', '373689', '373764', '373972']
nosy_count = 11.0
nosy_names = ['lars.gustaebel', 'larry', 'ned.deily', 'petr.viktorin', 'ethan.furman', 'mgorny', 'serhiy.storchaka', 'miss-islington', 'bc', 'jvoisin', 'rishi93']
pr_nums = ['21454', '21482', '21483', '21484', '21485', '21489']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue39017'
versions = ['Python 3.5', 'Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']
    @jvoisin
    Copy link
    Mannequin Author

    jvoisin mannequin commented Dec 10, 2019

    While playing with fuzzing and Python, I stumbled upon an infinite loop in Python's tarfile module: just open the attached file with tarfile.open('timeout-a52710a313fdb35fb428c3399277cb640fe2f686'), and Python will be endlessly stuck in the _proc_pax function in tarfile.py, likely due to a missing check of length being strictly superior to zero.

    @jvoisin jvoisin mannequin added 3.7 (EOL) end of life type-security A security issue labels Dec 10, 2019
    @bcaller
    Copy link
    Mannequin

    bcaller mannequin commented Jul 8, 2020

    I've attached a minimal tar file which reproduces this. I think the minimum length is 516 bytes.

    We need a 512 byte PAX format header block as normal.

    Then we need a pax header which matches the regex in

    cpython/Lib/tarfile.py

    Line 1243 in b26a0db

    regex = re.compile(br"(\d+) ([^=]+)=") 

    length, keyword = re.compile(br"(\d+) ([^=]+)=").groups()

    We use the length variable to iterate:

    cpython/Lib/tarfile.py

    Line 1271 in b26a0db

    pos += length 

        while True:
        ...
        pos += length

    So we can start the block with "0 X=". This makes length=0. So it will increment pos by 0 each loop and loop the same code forever.

    Nice find.

    Do you think this denial of service is worth requesting a CVE for? If so, can someone else do it.

    @bcaller
    Copy link
    Mannequin

    bcaller mannequin commented Jul 8, 2020

    A smaller bug: If instead of 0 you use a large number (> 2^63) e.g. 9999999999999999999 you get OverflowError: Python int too large to convert to C ssize_t rather than the expected tarfile.ReadError regardless of errorlevel.

    @rishi93
    Copy link
    Mannequin

    rishi93 mannequin commented Jul 10, 2020

    Hi ! I would like to start contributing to CPython. Can I start working on this issue ?

    @ethanfurman
    Copy link
    Member

    Absolutely!

    But first, you'll need to sign the Contributor License Agreement:

    https://www.python.org/psf/contrib/contrib-form/

    Thank you for your help!

    @rishi93
    Copy link
    Mannequin

    rishi93 mannequin commented Jul 12, 2020

    Thank you. I have signed the CLA agreement. I have pushed my code changes and also written a testcase for this issue

    @jvoisin
    Copy link
    Mannequin Author

    jvoisin mannequin commented Jul 14, 2020

    CVE-2019-20907 has been assigned to this issue.

    @encukou
    Copy link
    Member

    encukou commented Jul 15, 2020

    New changeset 5a8d121 by Rishi in branch 'master':
    bpo-39017: Avoid infinite loop in the tarfile module (GH-21454)
    5a8d121

    @encukou
    Copy link
    Member

    encukou commented Jul 15, 2020

    Larry and Ned, do you want this fix in the security-only releases you manage?

    PRs for 3.6 ad 3.7 are ready, should you wish to merge them.

    @miss-islington
    Copy link
    Contributor

    New changeset f323229 by Miss Islington (bot) in branch '3.9':
    [3.9] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (GH-21482)
    f323229

    @miss-islington
    Copy link
    Contributor

    New changeset c554795 by Miss Islington (bot) in branch '3.8':
    [3.8] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (GH-21483)
    c554795

    @larryhastings
    Copy link
    Contributor

    Yes, please. It's a simple low-risk fix. And 3.5.10rc1 is stuck waiting for a fix anyway. Thanks!

    @ned-deily
    Copy link
    Member

    New changeset 79c6b60 by Miss Islington (bot) in branch '3.7':
    bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (GH-21484)
    79c6b60

    @ned-deily
    Copy link
    Member

    New changeset 47a2955 by Miss Islington (bot) in branch '3.6':
    bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (bpo-21485)
    47a2955

    @ned-deily
    Copy link
    Member

    Thanks, the PRs for 3.7 and 3.6 are now merged.

    @ned-deily ned-deily added 3.8 only security fixes 3.9 only security fixes 3.10 only security fixes labels Jul 15, 2020
    @larryhastings
    Copy link
    Contributor

    New changeset cac9ca8 by Petr Viktorin in branch '3.5':
    [3.5] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (bpo-21489)
    cac9ca8

    @mgorny
    Copy link
    Mannequin

    mgorny mannequin commented Jul 19, 2020

    Given that a CVE was assigned for this, I think it'd be better if the news were in the 'Security' category and not 'Library'.

    @vstinner vstinner changed the title Infinite loop in the tarfile module [CVE-2019-20907] Infinite loop in the tarfile module Aug 3, 2020
    @vstinner vstinner changed the title Infinite loop in the tarfile module [CVE-2019-20907] Infinite loop in the tarfile module Aug 3, 2020
    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Assignees
    No one assigned
    Labels
    3.7 (EOL) end of life 3.8 only security fixes 3.9 only security fixes 3.10 only security fixes type-security A security issue
    Projects
    None yet
    Milestone
    No milestone
    Development

    No branches or pull requests
    5 participants
    @encukou @ned-deily @ethanfurman @larryhastings @miss-islington