search

sile / libflate

A Rust implementation of DEFLATE algorithm and related formats (ZLIB, GZIP)
https://docs.rs/libflate
MIT License
178 stars 35 forks source link

Use-after-free on panic in client code #35

Closed Shnatsel closed 5 years ago

Shnatsel commented 5 years ago

If the code that uses libflate panics, it may trigger a use-after-free in libflate code. Since use-after-free usually poses an arbitrary code execution vulnerability, I will relay further details privately to the maintainer.

Code compiled with panic=abort is not affected. This can be used as a mitigation in the interim.

Shnatsel commented 5 years ago

Fixed by #37. The problem is in this code: https://github.com/sile/libflate/blob/cbf1289f967c8fdff3b8ff3e06256ff7b62cc914/src/gzip.rs#L1122-L1129

The mere existence of mem::uninitialized() of a generic type is already undefined behavior. It's not clear how bad it is in practice exactly if this memory is never read. However, the definitely practical issue comes from the fact that a panic may happen on line 1127, before reaching mem::forget(), because the underlying reader provided by the API client may panic. It the panic occurs, drop() is called on the uninitialized memory, which is equivalent to a use-after-free bug, and use-after-free bugs are often exploitable.

Shnatsel commented 5 years ago

The issue was introduced in commit deadd75c47431e1336acdaf58bd2652e4be6f6c8 and affects releases 0.1.14 and onwards until the fix in 0.1.25.

@sile please yank versions 0.1.14 to 0.1.24 inclusive from crates.io. I'll handle the security advisory.

sile commented 5 years ago

@Shnatsel

please yank versions 0.1.14 to 0.1.24 inclusive from crates.io.

Done. Thank you for your contribution and advice.

Shnatsel commented 5 years ago

Closing now that the fix is released, vulnerable versions are yanked and a security advisory is filed.