Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list] 
Message-ID: <61a02a32-e18b-4a64-b581-6987558c2fd6@oracle.com>
Date: Fri, 14 Mar 2025 10:17:27 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: [CVE-2024-8176] Long linear chains of entities crash Expat with stack
 overflow due to use of unlimited recursion

On 3/15/24 09:57, Alan Coopersmith wrote:
> https://blog.hartwork.org/posts/expat-2-6-2-released/ (published 2024-03-13)
> announces the release of Expat 2.6.2, with security fixes:
[...]
> 
> The blog also points to the call for help maintaining libexpat in the Changelog
> at https://github.com/libexpat/libexpat/blob/R_2_6_2/expat/Changes which notes
> that items that need someone to work on include:
> 
> !! - <blink>fixing a complex non-public security issue</blink>,              !!

Expat 2.7.0 has now been released with a fix for that issue, and the issue has
been disclosed in:
    https://blog.hartwork.org/posts/expat-2-7-0-released/
    https://github.com/libexpat/libexpat/issues/893
    https://github.com/libexpat/libexpat/pull/973

Jann Horn of Google Project Zero is credited with reporting the issue, while
Siemens is credited with making the fix, and Red Hat, Linutronix, and a company
that would not like to be named, are credited for helping test the fix.

The short summary from the bug report:

    A long linear chain of entity references: long enough to force the recursion
    in Expat into stack overflow.

    How long the chain needs to be depends on the stack size of the target
    machine. To illustrate the structure:

    # python3 payload1.py 2
    <!DOCTYPE doc [
      <!ENTITY e0 ''>
      <!ENTITY e1 '&e0;'>
      <!ENTITY e2 '&e1;'>
    ]>
    <doc>&e2;</doc>

    # python3 payload2.py 2
    <!DOCTYPE a [
      <!ENTITY e0 ''>
      <!ENTITY e1 '&e0;'>
      <!ENTITY e2 '&e1;'>
    ]>
    <a key='&e2;'/>

    # python3 payload3.py 2
    <!DOCTYPE doc [
      <!ENTITY % p0 ''>
      <!ENTITY % p1 '&#37;p0;'>
      <!ENTITY % p2 '&#37;p1;'>
      <!ENTITY % define_g0 "<!ENTITY g0 '&#37;p2;'>">
      %define_g0;
    ]>
    <doc/>

(The payload*.py scripts are linked from
  https://github.com/libexpat/libexpat/issues/893)

The blog requests that "you please tell your friends:

     Please leave recursion to math and keep it out of (in particular C)
     software: it kills and will kill again.
     Kind regards from libexpat, see CVE-2022-25313 and CVE-2024-8176 for proof."

-- 
         -Alan Coopersmith-                 alan.coopersmith@...cle.com
          Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.