Source: lrzip
Version: 0.631-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/ckolivas/lrzip/issues/67
Hi,
the following vulnerability was published for lrzip.
CVE-2017-8847[0]:
| The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in
| lrzip 0.631 allows remote attackers to cause a denial of service (NULL
| pointer dereference and application crash) via a crafted archive.
./lrzip -t /root/poc/00229-lrzip-nullptr-bufRead-get
Decompressing...
Inconsistent length after decompression. Got 0 bytes, expected 2
ASAN:DEADLYSIGNAL
=================================================================
==15340==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc
0x000000459ef1 bp 0x7f4bf3031a90 sp 0x7f4bf3031a70 T2)
#0 0x459ef0 in bufRead::get() libzpaq/libzpaq.h:485
#1 0x44de34 in libzpaq::Decompresser::findBlock(double*)
libzpaq/libzpaq.cpp:1236
#2 0x44e45b in libzpaq::decompress(libzpaq::Reader*, libzpaq::Writer*)
libzpaq/libzpaq.cpp:1363
#3 0x445c2c in zpaq_decompress libzpaq/libzpaq.h:538
#4 0x428c2e in zpaq_decompress_buf stream.c:453
#5 0x430e60 in ucompthread stream.c:1534
#6 0x7f4c48e05493 in start_thread
(/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
#7 0x7f4c482ab93e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV libzpaq/libzpaq.h:485 in bufRead::get()
Thread T2 created by T0 here:
#0 0x7f4c49697f59 in __interceptor_pthread_create
(/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)
#1 0x4267f8 in create_pthread stream.c:133
#2 0x4325f0 in fill_buffer stream.c:1673
#3 0x4333d5 in read_stream stream.c:1755
#4 0x422b76 in unzip_literal runzip.c:162
#5 0x423ccb in runzip_chunk runzip.c:320
#6 0x4244a8 in runzip_fd runzip.c:382
#7 0x411378 in decompress_file lrzip.c:826
#8 0x409b39 in main main.c:669
#9 0x7f4c481e32b0 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
==15340==ABORTING
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2017-8847
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8847
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
