oss-security - expat vulnerability CVE-2024-8176 / impact of recursion stack overflow vulnerabilities

Follow @Openwall on Twitter for new release announcements and other news

Message-ID: <20250314195324.02b25dae@hboeck.de>
Date: Fri, 14 Mar 2025 19:53:24 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: expat vulnerability CVE-2024-8176 / impact of recursion stack
 overflow vulnerabilities

Hello,

A vulnerability (CVE-2024-8176) has been fixed in expat, a widely used
xml parser library:
https://blog.hartwork.org/posts/expat-2-7-0-released/
Info about the vuln has been posted here already. expat 2.7.0 fixes
multiple variations of stack overflows due to recursion and can be
triggered by using a large number of nested entities. Scripts to
generate example payloads for testing can be found in the project's
issue tracker: https://github.com/libexpat/libexpat/issues/893

I had some discussions with the maintainer of expat before this was
published about the security impact. We believe that this is likely, in
most cases, "only" a crash/denial of service type of bug.

Here is what I believe to be the case:

* Recursion stack overflow can lead to a stack clash, which might
  enable memory corruption and code execution. There has been some
  detailed investigation of this type of vulnerability by Qualys in
  2017:
  https://blog.qualys.com/vulnerabilities-threat-research/2017/06/19/the-stack-clash
  https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt

* As a response to this research, it was concluded that existing
  countermeasures for these types of vulnerabilities are insufficient,
  and a new compiler flag -fstack-clash-protection was introduced:
  https://developers.redhat.com/blog/2020/05/22/stack-clash-mitigation-in-gcc-part-3
  The -fstack-clash-protection flag is available in recent versions of
  gcc and clang, and many distributions have it enabled by default.
  There also have been changes to glibc and the Linux kernel in
  response:
  https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-1000366 (glibc)
  https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-1000364 (Linux
  kernel)

I believe from the above that current systems should not be vulnerable
to this type of vulnerability. I am unsure about systems that do not
apply -fstack-clash-protection. My understanding of these types of
vulnerabilities is limited, and by posting this here, I hope that
people more familiar with it will have a closer look. I am also not
sure how widely these mitigations have been applied and whether there
are major distributions not using -fstack-clash-protection by default.

-- 
Hanno Böck - Independent security researcher
https://itsec.hboeck.de/
https://badkeys.info/

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.