Bugzilla – Bug 963448
VUL-1: CVE-2016-2037: cpio: out of bounds write
Last modified: 2020-07-14 14:31:25 UTC
Created attachment 663098 [details] reproducer http://seclists.org/oss-sec/2016/q1/136 n out-of-bounds write in cpio 2.11 was found in the parsing of cpio files (other version are probably affected). Find attached a test case to reproduce it. The ASAN report is here: ================================================================= ==5480==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000edd0 at pc 0x41f187 bp 0x7fffffffdc50 sp 0x7fffffffdc48 WRITE of size 2 at 0x60200000edd0 thread T0 #0 0x41f186 in cpio_safer_name_suffix /home/g/Codigo/cpio-2.11+dfsg/src/util.c:1392 #1 0x40b3d7 in process_copy_in /home/g/Codigo/cpio-2.11+dfsg/src/copyin.c:1391 #2 0x416754 in main /home/g/Codigo/cpio-2.11+dfsg/src/main.c:739 #3 0x7ffff6b5eec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) #4 0x403408 (/home/g/Codigo/cpio-2.11+dfsg/src/cpio+0x403408) 0x60200000edd1 is located 0 bytes to the right of 1-byte region [0x60200000edd0,0x60200000edd1) allocated by thread T0 here: #0 0x7ffff6f567ef in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x547ef) #1 0x440f3e in xmalloc /home/g/Codigo/cpio-2.11+dfsg/gnu/xmalloc.c:47 #2 0x409c74 in read_in_new_ascii /home/g/Codigo/cpio-2.11+dfsg/src/copyin.c:1166 #3 0x408a26 in read_in_header /home/g/Codigo/cpio-2.11+dfsg/src/copyin.c:1043 #4 0x40b354 in process_copy_in /home/g/Codigo/cpio-2.11+dfsg/src/copyin.c:1361 #5 0x416754 in main /home/g/Codigo/cpio-2.11+dfsg/src/main.c:739 #6 0x7ffff6b5eec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) SUMMARY: AddressSanitizer: heap-buffer-overflow /home/g/Codigo/cpio-2.11+dfsg/src/util.c:1392 cpio_safer_name_suffix Shadow bytes around the buggy address: 0x0c047fff9d60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff9d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff9d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff9d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c047fff9db0: fa fa fa fa fa fa fa fa fa fa[01]fa fa fa 06 fa 0x0c047fff9dc0: fa fa 05 fa fa fa 00 04 fa fa 00 04 fa fa 00 04 0x0c047fff9dd0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 0x0c047fff9de0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 0x0c047fff9df0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa fd fa 0x0c047fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Contiguous container OOB:fc ASan internal: fe ==5480==ABORTING This issue was found using QuickFuzz. References: https://bugzilla.redhat.com/show_bug.cgi?id=1300207 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2037 http://seclists.org/oss-sec/2016/q1/180 http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-2037.html
on openSUSE 13.2 (without ASAN) $ cpio --extract < ../overflow_cpio.bin cpio: Malformed number0000000 cpio: warning: skipped 8 bytes of junk cpio: Substituting `.' for empty member name cpio: . not created: newer or same age version exists cpio: premature end of file Kristyna could you please have a look?
bugbot adjusting priority
All maintained cpio versions seem to be affected. Proposed fix: http://lists.gnu.org/archive/html/bug-cpio/2016-01/msg00005.html Reproducer: ---------- $ valgrind cpio -i < overflow_cpio.bin Results: <snip> ... ==16008== LEAK SUMMARY: ==16008== definitely lost: 0 bytes in 0 blocks ==16008== indirectly lost: 0 bytes in 0 blocks ==16008== possibly lost: 0 bytes in 0 blocks ==16008== still reachable: 1,537 bytes in 3 blocks ==16008== suppressed: 0 bytes in 0 blocks ==16008== Rerun with --leak-check=full to see details of leaked memory ==16008== ==16008== For counts of detected and suppressed errors, rerun with: -v ==16008== ERROR SUMMARY: 4 errors from 4 contexts (suppressed: 0 from 0) </snip>
Patch submitted to Factory by request #360528 Closing as fixed.
SUSE-SU-2017:0366-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 1020108,963448 CVE References: CVE-2016-2037 Sources used: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): cpio-2.11-32.1 SUSE Linux Enterprise Server 12-SP2 (src): cpio-2.11-32.1 SUSE Linux Enterprise Server 12-SP1 (src): cpio-2.11-32.1 SUSE Linux Enterprise Desktop 12-SP2 (src): cpio-2.11-32.1 SUSE Linux Enterprise Desktop 12-SP1 (src): cpio-2.11-32.1
Releasing for leap
openSUSE-SU-2017:0389-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 1020108,963448 CVE References: CVE-2016-2037 Sources used: openSUSE Leap 42.2 (src): cpio-2.11-33.1 openSUSE Leap 42.1 (src): cpio-2.11-32.1
Please note that we have a regression here. See bug 1028410 for more information.
released
Done