[<prev] [next>] [day] [month] [year] [list]
Message-ID: <YJD9guSqBQ4XsUWg@itl-email>
Date: Tue, 4 May 2021 03:53:38 -0400
From: Demi Marie Obenour <demi@...isiblethingslab.com>
To: oss-security@...ts.openwall.com
Cc: Marek Marczykowski-Górecki <marmarek@...isiblethingslab.com>,
Simon Gaiser <simon@...isiblethingslab.com>,
"Srivasta S. Bhat" <srivatsa@...il.mit.edu>
Subject: Multiple vulnerabilities in RPM
Through a combination of manual audits and fuzzing, I found several
vulnerabilities in RPM:
- RPM does not reject packages that have a signed header, but neither a
header+payload signature nor a payload digest. Furthermore, `rpmkeys
-K` reports `digests signatures OK` for such packages. Such a package
is obviously not validly signed, but RPM nevertheless accepts it.
This can be mitigated by setting `%_pkgverify_level` to `signature`
or `all`. I consider it a vulnerability as it violates an assumption
made by much of the RPM ecosystem: if a package has any signatures,
RPM will (by default) error out when trying to install it, unless
the entire package has been properly signed by a trusted key.
- RPM’s parser for OpenPGP packets has multiple memory unsafety
issues, including out-of-bounds reads and out-of-bounds pointer
arithmetic. On 32-bit systems, integer overflows and an infinite
loop are also possible. It may be possible to use this vulnerability
to modify a package (that is signed by a trusted key) such that
it still validates as properly signed, but installing it corrupts
the RPMDB.
I also found two issues that are not vulnerabilities per se, but which
I still believe should be fixed:
- RPM accepts signatures that are followed by other OpenPGP packets,
which are not valid. This opens additional attack surface.
- RPM does not (obviously) reject signatures that are of an incorrect
type. I am not sure that they do not wind up being rejected in other
ways, and even if they are not, I am not sure if this is helpful to
an attacker. But the fix is trivial, so I included it in the patch.
The attached patches fix both issues. The patch sent to distros@ had a
(non-exploitable) integer overflow bug on 32-bit systems, as was pointed
out by Seth Arnold.
Sincerely,
Demi Marie Obenour
she/her/hers
Qubes OS Developer, Invisible Things Lab
View attachment "0001-Fix-OpenPGP-parsing-bugs.patch" of type "text/plain" (9354 bytes)
View attachment "0002-Header-signatures-alone-are-not-sufficient.patch" of type "text/plain" (7244 bytes)
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
