bugGNU tar - Bugs: bug #59897, Memory Leak GNU Tar 1.33

 
 

bug #59897: Memory Leak GNU Tar 1.33

Submitter:  Carlos Andres Ramirez <carlos_ramirez>
Submitted:  Sun 17 Jan 2021 01:11:34 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  gray
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 19 Jan 2021 12:46:42 AM UTC, comment #2: 


Thank you Sergey for your quick fix.
This has been assigned ID CVE-2021-20193.

---
Carlos

Carlos Andres Ramirez <carlos_ramirez>
Sun 17 Jan 2021 06:48:58 PM UTC, comment #1: 

Fixed in commit d9d4435692150fa8ff68e1b1a473d187cc3fd777.  Thank you.

Sergey Poznyakoff <gray>
Group administrator
Sun 17 Jan 2021 01:11:34 PM UTC, original submission:  

An issue was discovered in GNU Tar 1.33 and earlier. There is a memory leak in read_header() in list.c in the tar application.

Occasionally, ASAN detects an out of bounds memory read, but always reports the memory leak. Valgrind confirms the memory leak in the standard tar tool installed by default. This degrades the availability of the tar tool, and could potentially result in other memory-related issues (some fuzzed binaries stay in a loop for over 7 seconds before return).

Common Weakness Enumeration IDs for reference:
CWE-401: Missing Release of Memory after Effective Lifetime
CWE-125: Out-of-bounds Read

Attached to this report is a PoC malcrafted file "1311745-out-bounds.tar"

VALGRIND OUTPUT:
...
==3776== LEAK SUMMARY:
==3776== definitely lost: 1,311,745 bytes in 1 blocks
...

NOTE: Version 1.30, 1.32, 1.33 were downloaded/tested and confirmed to be vulnerable. Standard installs in Ubuntu, Kali and Fedora also were tested and have the same issue.

NOTE 2: The issue seems to be the "written" variable that holds the number of written bytes. During fuzzing, the application behaves differently under different inputs, but the memory leak / out of bounds report is the common issue seen.

I will update the ticket if I can manage to find out more.

---
Carlos

Carlos Andres Ramirez <carlos_ramirez>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #50730:  1311745-out-bounds.tar added by carlos_ramirez (2KiB - application/x-tar)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gray (Updated the item)
  • -email is unavailable- added by carlos_ramirez (Submitted the item)
  • -email is unavailable- added by carlos_ramirez
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-01-17 gray StatusNone Fixed
        Assigned toNone gray
        Open/ClosedOpen Closed
    2021-01-17 gray PrivacyPrivate Public
    2021-01-17 carlos_ramirez Attached File- Added 1311745-out-bounds.tar, #50730
        Attached File- Added ASAN-Output-Confirmed-Leak.png, #50731
        Attached File- Added Valgrind-Output-Confirmed-Leak.png, #50732
        Carbon-Copy- Added carlos_ramirez

    Back to the top

    Powered by Savane 3.13-461b.
    Corresponding source code