oss-security - CVE request: python: _json module is vulnerable to arbitrary process memory read

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140623140208.GB16963@mail.corp.redhat.com>
Date: Mon, 23 Jun 2014 16:02:08 +0200
From: Vasyl Kaigorodov <vkaigoro@...hat.com>
To: oss-security@...ts.openwall.com
Cc: 752395@...s.debian.org
Subject: CVE request: python: _json module is vulnerable to arbitrary process
 memory read

Hello,

It was reported [1] that Python built-in _json module have a flaw
(insufficient bounds checking), which allows a local user to read
current process' arbitrary memory.
From initial bug report [1]:
...
The sole prerequisites of this attack are that the attacker is able to
control or influence the two parameters of the default scanstring
function: the string to be decoded and the index.

The bug is caused by allowing the user to supply a negative index
value. The index value is then used directly as an index to an array
in the C code; internally the address of the array and its index are
added to each other in order to yield the address of the value that is
desired. However, by supplying a negative index value and adding this
to the address of the array, the processor's register value wraps
around and the calculated value will point to a position in memory
which isn't within the bounds of the supplied string, causing the
function to access other parts of the process memory.
...

Can a CVE ID be assigned to this issue please?
Also CC'ing the Debian bugreport here.

References:
[1] Upstream bug report with additional technical details: http://bugs.python.org/issue21529
[2] Debian bug tracker: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=752395
[3] RedHat bug tracker: https://bugzilla.redhat.com/show_bug.cgi?id=1112285

Thanks.
-- 
Vasyl Kaigorodov | Red Hat Product Security Team
PGP:  0xABB6E828 A7E0 87FF 5AB5 48EB 47D0 2868 217B F9FC ABB6 E828

Content of type "application/pgp-signature" skipped

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.