Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[CVE-2020-14422] Hash collisions in IPv4Interface and IPv6Interface #85176

Closed
marwenn02 mannequin opened this issue Jun 17, 2020 · 18 comments
Closed

[CVE-2020-14422] Hash collisions in IPv4Interface and IPv6Interface #85176

marwenn02 mannequin opened this issue Jun 17, 2020 · 18 comments
Labels
3.7 (EOL) end of life 3.8 only security fixes 3.9 only security fixes 3.10 only security fixes easy stdlib Python modules in the Lib dir type-security A security issue

Comments

@marwenn02
Copy link
Mannequin

marwenn02 mannequin commented Jun 17, 2020

BPO 41004
Nosy @jcea, @larryhastings, @ericvsmith, @ned-deily, @corona10, @miss-islington, @tapakund, @amiremohamadi, @Beuc, @marwenn02, @sreev, @rvteja92
PRs
  • bpo-41004: IPv4Interface, and IPv6Interface hash collisions  #20956
  • bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface #21033
  • [3.9] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033) #21220
  • [3.8] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033) #21221
  • [3.7] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interfac… #21231
  • [3.6] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6In… #21232
  • [3.5] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6In… #21233
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2020-08-04.02:35:49.608>
created_at = <Date 2020-06-17.13:11:52.313>
labels = ['type-security', 'easy', '3.8', '3.9', '3.10', '3.7', 'library']
title = '[CVE-2020-14422] Hash collisions in IPv4Interface and IPv6Interface'
updated_at = <Date 2020-08-04.02:35:49.607>
user = 'https://github.com/marwenn02'

    bugs.python.org fields:

    activity = <Date 2020-08-04.02:35:49.607>
actor = 'larry'
assignee = 'none'
closed = True
closed_date = <Date 2020-08-04.02:35:49.608>
closer = 'larry'
components = ['Library (Lib)']
creation = <Date 2020-06-17.13:11:52.313>
creator = 'nnewram'
dependencies = []
files = []
hgrepos = []
issue_num = 41004
keywords = ['patch', 'easy']
message_count = 18.0
messages = ['371738', '371768', '371770', '371793', '371794', '371882', '372030', '372031', '372515', '372606', '372611', '372612', '372677', '372679', '372695', '372720', '372721', '374787']
nosy_count = 12.0
nosy_names = ['jcea', 'larry', 'eric.smith', 'ned.deily', 'corona10', 'miss-islington', 'tapakund', 'Amir', 'Beuc', 'nnewram', 'svaddi', 'rvteja92']
pr_nums = ['20956', '21033', '21220', '21221', '21231', '21232', '21233']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue41004'
versions = ['Python 3.5', 'Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']
    @marwenn02
    Copy link
    Mannequin Author

    marwenn02 mannequin commented Jun 17, 2020

    In the ipaddress library there exists two classes IPv4Interface, and IPv6Interface. These classes' hash functions will always return 32 and 64 respectively. If IPv4Interface or IPv6Interface objects then are put in a dictionary, on for example a server storing IPs, this will cause hash collisions, which in turn can lead to DOS.

    The root of this is on line 1421 and 2095. On both lines, self._ip and self.network.network_address will both be same, and when xor is applied they will cancel eachother out, leaving return self._prefixlen .
    Since self._prefixlen is a constant, 32 and 64 respectively, this will lead to a constant hash.

    The fix is trivial, on line 1421, change to:
    return hash((self._ip, self._prefixlen, int(self.network.network_address)))

    and on line 2095, change to:
    return hash((self._ip, self._prefixlen, int(self.network.network_address)))

    @marwenn02 marwenn02 mannequin added 3.8 only security fixes stdlib Python modules in the Lib dir type-security A security issue labels Jun 17, 2020
    @ericvsmith
    Copy link
    Member

    Good catch. Your approach seems like a good one.

    @marwenn02 marwenn02 mannequin added 3.10 only security fixes and removed 3.8 only security fixes labels Jun 17, 2020
    @marwenn02
    Copy link
    Mannequin Author

    marwenn02 mannequin commented Jun 17, 2020

    Forgot to add, this applies to all versions, 3.10, 3.9, 3.8, 3.7, 3.6, 3.5

    @marwenn02 marwenn02 mannequin added 3.7 (EOL) end of life 3.8 only security fixes 3.9 only security fixes labels Jun 17, 2020
    @amiremohamadi
    Copy link
    Mannequin

    amiremohamadi mannequin commented Jun 18, 2020

    Can I make a PR for this?

    @marwenn02
    Copy link
    Mannequin Author

    marwenn02 mannequin commented Jun 18, 2020

    Absolutely, go ahead Amir

    @ericvsmith
    Copy link
    Member

    Changing versions to where the fix would be applied.

    @ericvsmith ericvsmith removed 3.7 (EOL) end of life labels Jun 19, 2020
    @rvteja92
    Copy link
    Mannequin

    rvteja92 mannequin commented Jun 22, 2020

    Hi
    I have raised a PR for this. But my PLA is yet to be updated (I have singed it).

    But add the fix to the existing versions (3.8, 3.9 and 3.10), do I need to raise PR for each of those branches?

    @amiremohamadi
    Copy link
    Mannequin

    amiremohamadi mannequin commented Jun 22, 2020

    No @rvteja92, you don't need open multiple PRs, only make your changes on master branch. for more informations read this:
    https://devguide.python.org/

    And for the CLA sign it will take a while to be updated.

    @rvteja92
    Copy link
    Mannequin

    rvteja92 mannequin commented Jun 28, 2020

    Hi

    My CLA has been approved. Can someone review the PR.

    @ericvsmith
    Copy link
    Member

    New changeset b30ee26 by Ravi Teja P in branch 'master':
    bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033)
    b30ee26

    @miss-islington
    Copy link
    Contributor

    New changeset dc8ce8e by Miss Islington (bot) in branch '3.8':
    bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033)
    dc8ce8e

    @miss-islington
    Copy link
    Contributor

    New changeset 9a646aa by Miss Islington (bot) in branch '3.9':
    bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033)
    9a646aa

    @ericvsmith ericvsmith self-assigned this Jun 29, 2020
    @ericvsmith ericvsmith self-assigned this Jun 29, 2020
    @ericvsmith
    Copy link
    Member

    Ned: what are your thoughts on backporting this as a security issue?

    https://nvd.nist.gov/vuln/detail?vulnId=CVE-2020-14422

    @corona10 corona10 added the 3.7 (EOL) end of life label Jun 30, 2020
    @corona10 corona10 reopened this Jun 30, 2020
    @corona10 corona10 added the 3.7 (EOL) end of life label Jun 30, 2020
    @corona10 corona10 reopened this Jun 30, 2020
    @corona10
    Copy link
    Member

    https://nvd.nist.gov/vuln/detail?vulnId=CVE-2020-14422

    As Eric said, this issue is assigned a CVE-2020-14422.
    I re-open PRs for 3.5 - 3.7 and waiting for other core developers guide.

    I am +1 on merge this PRs as the security patch.

    @ned-deily
    Copy link
    Member

    A legitimate CVE should certainly be backported to all applicable releases, so, yes. However, I think that it is important for the CVE to be mentioned in the NEWS blurbs for each commit. So please update the NEWS items in each open PR to include the CVE. For master and 3.9 (if you hurry), you can update the original blurb file. For 3.8, the blurb file is in the process of being merged into the blurb for the release; for it, wait until the v3.8.4rc1 has been merged back into the main cpython repo and then update the merged the blob, please. Thanks!

    @ned-deily
    Copy link
    Member

    New changeset b98e779 by Tapas Kundu in branch '3.7':
    [3.7] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033) (GH-21231)
    b98e779

    @ned-deily
    Copy link
    Member

    New changeset cfc7ff8 by Tapas Kundu in branch '3.6':
    [3.6] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033) (GH-21232)
    cfc7ff8

    @vstinner vstinner changed the title Hash collisions in IPv4Interface and IPv6Interface [CVE-2020-14422] Hash collisions in IPv4Interface and IPv6Interface Jul 9, 2020
    @vstinner vstinner changed the title Hash collisions in IPv4Interface and IPv6Interface [CVE-2020-14422] Hash collisions in IPv4Interface and IPv6Interface Jul 9, 2020
    @larryhastings
    Copy link
    Contributor

    New changeset 11d258c by Tapas Kundu in branch '3.5':
    [3.5] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033) (bpo-21233)
    11d258c

    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Assignees
    No one assigned
    Labels
    3.7 (EOL) end of life 3.8 only security fixes 3.9 only security fixes 3.10 only security fixes easy stdlib Python modules in the Lib dir type-security A security issue
    Projects
    None yet
    Milestone
    No milestone
    Development

    No branches or pull requests
    5 participants
    @ericvsmith @corona10 @ned-deily @larryhastings @miss-islington