buffer overflow in socket.recvfrom_into #64445

rmsr · 2014-01-14T00:43:59Z

BPO	20246
Nosy	@pefu, @ncoghlan, @pitrou, @giampaolo, @tiran, @ezio-melotti, @bitdancer, @skrah, @koobs
Files	recvfrom_into_buffer_overflow_3.4.patch: patch against v3.4 recvfrom_into_buffer_overflow_2.7.patch: patch against 2.7 recvfrom_into_small_buffer_test.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2014-01-14.04:15:07.334>
created_at = <Date 2014-01-14.00:43:59.168>
labels = ['type-security', 'extension-modules']
title = 'buffer overflow in socket.recvfrom_into'
updated_at = <Date 2014-03-01.07:16:38.971>
user = 'https://bugs.python.org/rmsr'

bugs.python.org fields:

activity = <Date 2014-03-01.07:16:38.971>
actor = 'koobs'
assignee = 'none'
closed = True
closed_date = <Date 2014-01-14.04:15:07.334>
closer = 'python-dev'
components = ['Extension Modules']
creation = <Date 2014-01-14.00:43:59.168>
creator = 'rmsr'
dependencies = []
files = ['33452', '33453', '33573']
hgrepos = []
issue_num = 20246
keywords = ['patch']
message_count = 24.0
messages = ['208062', '208066', '208070', '208422', '208428', '208501', '208580', '208711', '208712', '212165', '212166', '212167', '212168', '212179', '212196', '212206', '212207', '212208', '212248', '212249', '212253', '212418', '212489', '212490']
nosy_count = 13.0
nosy_names = ['pefu', 'ncoghlan', 'pitrou', 'giampaolo.rodola', 'christian.heimes', 'rmsr', 'ezio.melotti', 'r.david.murray', 'cvrebert', 'skrah', 'offby1', 'python-dev', 'koobs']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue20246'
versions = ['Python 3.1', 'Python 2.7', 'Python 3.2', 'Python 3.3', 'Python 3.4']

rmsr · 2014-01-14T00:43:59Z

recvfrom_into fails to check that the supplied buffer object is big enough for the requested read and so will happily write off the end.

I will attach patches for 3.4 and 2.7, I'm not familiar with the backporting procedure to go further but all versions since 2.5 have this bug and while very highly unlikely it's technically remotely exploitable.

Quickie trigger script, crash on interpreter exit:

--------- BEGIN SEGFAULT ---------

import socket
r, w = socket.socketpair()
w.send(b'X' * 1024)
r.recvfrom_into(bytearray(), 1024)

bitdancer · 2014-01-14T02:35:35Z

Everything before 2.7 is already out of even security maintenance, so you've already checked off everything it will get fixed in.

python-dev · 2014-01-14T04:15:07Z

New changeset 87673659d8f7 by Benjamin Peterson in branch '2.7':
complain when nbytes > buflen to fix possible buffer overflow (closes bpo-20246)
http://hg.python.org/cpython/rev/87673659d8f7

New changeset 715fd3d8ac93 by Benjamin Peterson in branch '3.1':
complain when nbytes > buflen to fix possible buffer overflow (closes bpo-20246)
http://hg.python.org/cpython/rev/715fd3d8ac93

New changeset 9c56217e5c79 by Benjamin Peterson in branch '3.2':
complain when nbytes > buflen to fix possible buffer overflow (closes bpo-20246)
http://hg.python.org/cpython/rev/9c56217e5c79

New changeset 7f176a45211f by Benjamin Peterson in branch '3.3':
merge 3.2 (bpo-20246)
http://hg.python.org/cpython/rev/7f176a45211f

New changeset ead74e54d68f by Benjamin Peterson in branch 'default':
merge 3.3 (bpo-20246)
http://hg.python.org/cpython/rev/ead74e54d68f

New changeset 37ed85008f51 by Benjamin Peterson in branch 'default':
merge 3.3 (bpo-20246)
http://hg.python.org/cpython/rev/37ed85008f51

skrah · 2014-01-18T23:05:23Z

One test fails on FreeBSD 9.0 and 6.4:

======================================================================
ERROR: testRecvFromIntoSmallBuffer (test.test_socket.BufferIOTest)
----------------------------------------------------------------------

Traceback (most recent call last):
  File "/usr/home/db3l/buildarea/3.x.bolen-freebsd/build/Lib/test/test_socket.py", line 259, in _tearDown
    raise exc
  File "/usr/home/db3l/buildarea/3.x.bolen-freebsd/build/Lib/test/test_socket.py", line 271, in clientRun
    test_func()
  File "/usr/home/db3l/buildarea/3.x.bolen-freebsd/build/Lib/test/test_socket.py", line 4690, in _testRecvFromIntoSmallBuffer
    self.serv_conn.send(MSG*2048)
BrokenPipeError: [Errno 32] Broken pipe

rmsr · 2014-01-19T00:55:11Z

Perhaps the test is sending an infeasibly large message. If you remove the '*2048' does it pass? (I set up a FreeBSD 9.2 amd64 VM but all tests are passing here).

skrah · 2014-01-19T21:33:27Z

MSG*1024 passes. I did not look at this issue: Would changing the value to 1024
invalidate the test?

rmsr · 2014-01-20T20:46:56Z

The send part of the test doesn't matter, since what's being tested happens before any reads. The MSG multiplier should be removed completely, since none of the other tests do that.

Patch attached.

python-dev · 2014-01-21T22:07:02Z

New changeset 5c4f4db8107c by Stefan Krah in branch '3.3':
Issue bpo-20246: Fix test failures on FreeBSD. Patch by Ryan Smith-Roberts.
http://hg.python.org/cpython/rev/5c4f4db8107c

New changeset 9bbc3cc8ff4c by Stefan Krah in branch 'default':
Issue bpo-20246: Fix test failures on FreeBSD. Patch by Ryan Smith-Roberts.
http://hg.python.org/cpython/rev/9bbc3cc8ff4c

New changeset b6c5a37b221f by Stefan Krah in branch '2.7':
Issue bpo-20246: Fix test failures on FreeBSD. Patch by Ryan Smith-Roberts.
http://hg.python.org/cpython/rev/b6c5a37b221f

skrah · 2014-01-21T22:11:37Z

Thanks Ryan. As you say, the original segfault is also triggered with the
shortened message.

tiran · 2014-02-25T07:23:38Z

I just came across https://www.trustedsec.com/february-2014/python-remote-code-execution-socket-recvfrom_into/ . Now I wonder why this bug was neither reported to PSRT nor get a CVE number. It's a buffer overflow...

I'm going to contact MITRE right away.

ncoghlan · 2014-02-25T07:43:05Z

Branch status:

Vulnerable (last release prior to patch):
2.7.6
3.1.5
3.2.5

Fixed (latest release post patch):
3.3.4+
3.4

So my reading is that 2.7.7 needs to be brought forward, and source only releases of 3.1.6 and 3.2.6 should be published.

It also sounds like there's a missing trigger that automatically notifies PSRT when someone else classifies a bug as a security bug.

ncoghlan · 2014-02-25T07:52:16Z

Confirming the fix is in the 3.3.4 tag: http://hg.python.org/cpython/file/7ff62415e426/Lib/test/test_socket.py#l4539

And the 3.4rc1 tag: http://hg.python.org/cpython/file/5e088cea8660/Lib/test/test_socket.py#l4708

tiran · 2014-02-25T08:20:27Z

This issue has already been assigned CVE-2014-1912

Reference:

http://www.openwall.com/lists/oss-security/2014/02/12/16
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-1912

bitdancer · 2014-02-25T14:17:59Z

We don't currently have the capability to set an email trigger when the type is set to security. That should be submitted as a request on the meta tracker. (It will require a new reactor, which is easy, and a tweak to the database schema, which I don't offhand remember how to deploy, but it shouldn't be hard.)

offby1 · 2014-02-25T18:48:09Z

Is there an ETA for a 2.7.7 release with this fix?

rmsr · 2014-02-25T19:52:28Z

I notified security@python.org and waited for the go-ahead (from Guido I think) before opening this bug. If today is the first that the PSRT is hearing about this, then the issue is broader than just the bugtracker.

pitrou · 2014-02-25T19:55:25Z

Yes, your message reached PSRT on Jan 12th.

tiran · 2014-02-25T19:56:31Z

Sorry, you are right and I was wrong. :(

Your mail *was* delivered to PSRT. But it failed to reach me because I was having issues with my @python.org account. The server-side spam filter is now deactivated and I receive all mails again.

pefu · 2014-02-26T11:25:45Z

A recently posted proof of concept exploit got a lot of attention:

https://www.trustedsec.com/february-2014/python-remote-code-execution-socket-recvfrom_into/

I suggest some Python core developer should clarify here whether people running some publically available python based web service
(Zope, Plone, Roundup, MoinMoin, or whatever) are vulnerable or not.

pitrou · 2014-02-26T11:28:44Z

recvfrom_into() is hardly ever used, including in the stdlib itself.
People using third-party software should check that the software itself doesn't call this method (chances are it doesn't).

pefu · 2014-02-26T13:07:48Z

Antoine Pitrou:

recvfrom_into() is hardly ever used, including in the stdlib itself.

Thank you for the quick clarification.
This will certainly help to calm down nervous people.

Best regards, Peter.

koobs · 2014-02-28T10:27:15Z

Can somebody backport the fixes for the test breakages to 3.1 and 3.2 please, it seems they were forgotten.

The original CVE fix includes changes to test_socket.py so I cant imagine security-only-fix policy applies.

Thanks!

python-dev · 2014-03-01T07:04:20Z

New changeset c25e1442529f by Stefan Krah in branch '3.1':
Issue bpo-20246: Fix test failures on FreeBSD. Patch by Ryan Smith-Roberts.
http://hg.python.org/cpython/rev/c25e1442529f

New changeset e82dcd700e8c by Stefan Krah in branch '3.2':
Issue bpo-20246: Fix test failures on FreeBSD. Patch by Ryan Smith-Roberts.
http://hg.python.org/cpython/rev/e82dcd700e8c

koobs · 2014-03-01T07:16:39Z

Thank you Stefan

rmsr mannequin added type-crash A hard crash of the interpreter, possibly with a core dump extension-modules C modules in the Modules dir labels Jan 14, 2014

bitdancer added type-security A security issue and removed type-crash A hard crash of the interpreter, possibly with a core dump labels Jan 14, 2014

python-dev mannequin closed this as completed Jan 14, 2014

ezio-melotti transferred this issue from another repository Apr 10, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

buffer overflow in socket.recvfrom_into #64445

buffer overflow in socket.recvfrom_into #64445

rmsr mannequin commented Jan 14, 2014

rmsr mannequin commented Jan 14, 2014

bitdancer commented Jan 14, 2014

python-dev mannequin commented Jan 14, 2014

skrah mannequin commented Jan 18, 2014

rmsr mannequin commented Jan 19, 2014

skrah mannequin commented Jan 19, 2014

rmsr mannequin commented Jan 20, 2014

python-dev mannequin commented Jan 21, 2014

skrah mannequin commented Jan 21, 2014

tiran commented Feb 25, 2014

ncoghlan commented Feb 25, 2014

ncoghlan commented Feb 25, 2014

tiran commented Feb 25, 2014

bitdancer commented Feb 25, 2014

offby1 mannequin commented Feb 25, 2014

rmsr mannequin commented Feb 25, 2014

pitrou commented Feb 25, 2014

tiran commented Feb 25, 2014

pefu mannequin commented Feb 26, 2014

pitrou commented Feb 26, 2014

pefu mannequin commented Feb 26, 2014

koobs commented Feb 28, 2014

python-dev mannequin commented Mar 1, 2014

koobs commented Mar 1, 2014

buffer overflow in socket.recvfrom_into #64445

buffer overflow in socket.recvfrom_into #64445

Comments

rmsr mannequin commented Jan 14, 2014

rmsr mannequin commented Jan 14, 2014

bitdancer commented Jan 14, 2014

python-dev mannequin commented Jan 14, 2014

skrah mannequin commented Jan 18, 2014

rmsr mannequin commented Jan 19, 2014

skrah mannequin commented Jan 19, 2014

rmsr mannequin commented Jan 20, 2014

python-dev mannequin commented Jan 21, 2014

skrah mannequin commented Jan 21, 2014

tiran commented Feb 25, 2014

ncoghlan commented Feb 25, 2014

ncoghlan commented Feb 25, 2014

tiran commented Feb 25, 2014

bitdancer commented Feb 25, 2014

offby1 mannequin commented Feb 25, 2014

rmsr mannequin commented Feb 25, 2014

pitrou commented Feb 25, 2014

tiran commented Feb 25, 2014

pefu mannequin commented Feb 26, 2014

pitrou commented Feb 26, 2014

pefu mannequin commented Feb 26, 2014

koobs commented Feb 28, 2014

python-dev mannequin commented Mar 1, 2014

koobs commented Mar 1, 2014