Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Test 224 fails with CVE-2022-37434 patched zlib #9271

Closed
winterqt opened this issue Aug 7, 2022 · 12 comments
Closed

Test 224 fails with CVE-2022-37434 patched zlib #9271

winterqt opened this issue Aug 7, 2022 · 12 comments
Assignees
@bagder
Labels
crash not-a-curl-bug This is not a bug in curl tests

Comments

@winterqt
Copy link

winterqt commented Aug 7, 2022 •
edited
Loading

I did this

Using zlib v1.2.12 patched for CVE-2022-37434:

make test
# or...
cd tests
./runtests.pl 224

test 0224...[HTTP GET gzip compressed content with huge comment and extra field]

 224: data FAILED:
--- log/check-expected	2022-08-07 23:29:39.568010972 +0000
+++ log/check-generated	2022-08-07 23:29:39.568010972 +0000
@@ -1,9 +0,0 @@
-HTTP/1.1 200 OK[CR][LF]
-Date: Mon, 29 Nov 2004 21:56:53 GMT[CR][LF]
-Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29[CR][LF]
-Vary: Accept-Encoding[CR][LF]
-Content-Type: text/html; charset=ISO-8859-1[CR][LF]
-Content-Encoding: gzip[CR][LF]
-Content-Length: 2186[CR][LF]
-[CR][LF]
-uncompressed gzip data with long gzip header[LF]

I've also seen this test failure accompanied by a segfault, but this only happens within a sandbox (which uses the Linux kernel's namespacing feature):

test 0224...core dumped
FAILED

I expected the following

For the test to succeed.

curl/libcurl version

7.84.0

operating system

Linux 5.15.43 #1-NixOS SMP Wed May 25 12:42:07 UTC 2022 aarch64 GNU/Linux

This very much could be a zlib issue since the patch in question hasn't made it into a release yet, but I'm going to leave this open just in case it's not; feel free to close.
@bagder bagder self-assigned this Aug 8, 2022
@bagder
Copy link
Member

bagder commented Aug 8, 2022

I can reproduce the crash when madler/zlib@eff308a is present and I can confirm that this test case makes zlib:inflate() segfault.

Breakpoint 1, inflate_stream (data=0x55555573cb68, writer=0x55555577fd08, started=ZLIB_INIT_GZIP) at content_encoding.c:198
198         status = inflate(z, Z_BLOCK);
(gdb) n

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7cedc7d in inflate () from /home/daniel/build-zlib/lib/libz.so.1
(gdb)

bagder referenced this issue in madler/zlib Aug 8, 2022
Fix a bug when getting a gzip header extra field with inflate().
eff308a 
If the extra field was larger than the space the user provided with
inflateGetHeader(), and if multiple calls of inflate() delivered
the extra header data, then there could be a buffer overflow of the
provided space. This commit assures that provided space is not
exceeded.
@bagder
Copy link
Member

bagder commented Aug 8, 2022

This is a zlib issue.

@bagder bagder added the not-a-curl-bug This is not a bug in curl label Aug 8, 2022
@bagder
Copy link
Member

bagder commented Aug 8, 2022

Since this is a bug in zlib causing the crash and not in curl, I'm closing.

@bagder bagder closed this as completed Aug 8, 2022
@Neustradamus Neustradamus mentioned this issue Aug 8, 2022
Closed
@madler
Copy link

madler commented Aug 8, 2022

Thanks for the report. Should be fixed in madler/zlib@1eb7682 .

@winterqt winterqt mentioned this issue Aug 8, 2022
Merged
13 tasks
@bagder
Copy link
Member

bagder commented Aug 8, 2022

@madler the current develop branch is confirmed to work fine for me with curl test 224 ✔️

@madler
Copy link

madler commented Aug 8, 2022

@bagder Excellent, thanks!

@winterqt
Copy link
Author

winterqt commented Aug 9, 2022

@madler I and others have also confirmed that this fixes not only the curl issues, but other software as well. Thank you for the quick response!

@madler
Copy link

madler commented Aug 9, 2022

Thank you for the confirmations of the fix.

jow- pushed a commit to lede-project/source that referenced this issue Aug 9, 2022
@ynezz
zlib: backport null dereference fix
f443e9d 
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 7df6795 ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.

References: curl/curl#9271
Fixes: 7df6795 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
jow- pushed a commit to openwrt/openwrt that referenced this issue Aug 9, 2022
@ynezz
zlib: backport null dereference fix
707ec48 
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 7df6795 ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.

References: curl/curl#9271
Fixes: 7df6795 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit f443e9d)
jow- pushed a commit to openwrt/openwrt that referenced this issue Aug 9, 2022
@ynezz
zlib: backport null dereference fix
b93327c 
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 7df6795 ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.

References: curl/curl#9271
Fixes: 7df6795 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit f443e9d)
(cherry picked from commit 707ec48)
HiGarfield pushed a commit to HiGarfield/lede-17.01.4-Mod that referenced this issue Aug 9, 2022
@ynezz @HiGarfield
zlib: backport null dereference fix
9a10009 
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 7df6795d4c25 ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.

References: curl/curl#9271
Fixes: 7df6795d4c25 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
vszakats added a commit to curl/curl-for-win that referenced this issue Aug 9, 2022
@vszakats
zlib: patch CVE-2022-37434
55cddd4 
Refs:
madler/zlib@eff308a (patch)
madler/zlib@1eb7682 (crash fix for the patch)

CVE:
https://nvd.nist.gov/vuln/detail/CVE-2022-37434
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37434
https://www.cve.org/CVERecord?id=CVE-2022-37434

curl/curl#9271
aiamadeus pushed a commit to coolsnowwolf/lede that referenced this issue Aug 10, 2022
@ynezz @aiamadeus
zlib: backport null dereference fix
27befb4 
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 7df6795 ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.

References: curl/curl#9271
Fixes: 7df6795 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
467815891a pushed a commit to 467815891a/lede that referenced this issue Aug 10, 2022
@ynezz @467815891a
zlib: backport null dereference fix
581551a 
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 7df6795 ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.

References: curl/curl#9271
Fixes: 7df6795 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
misaka36 pushed a commit to misaka36/lede that referenced this issue Aug 10, 2022
@ynezz @misaka36
zlib: backport null dereference fix
0de3741 
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 7df6795 ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.

References: curl/curl#9271
Fixes: 7df6795 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
HiGarfield pushed a commit to HiGarfield/lede-17.01.4-Mod that referenced this issue Aug 10, 2022
@ynezz @HiGarfield
zlib: backport null dereference fix
43d9a82 
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 7df6795d4c25 ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.

References: curl/curl#9271
Fixes: 7df6795d4c25 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Vladdrako pushed a commit to Vladdrako/openwrt that referenced this issue Aug 10, 2022
@ynezz @Vladdrako
zlib: backport null dereference fix
385f562 
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 7df6795 ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.

References: curl/curl#9271
Fixes: 7df6795 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
AnhDQHE181109 pushed a commit to AnhDQHE181109/openwrt-841hp-v5 that referenced this issue Aug 14, 2022
@ynezz @AnhDQHE181109
zlib: backport null dereference fix
7545198 
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 7df6795 ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.

References: curl/curl#9271
Fixes: 7df6795 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
@s1gkill s1gkill mentioned this issue Aug 16, 2022
Closed
HiGarfield pushed a commit to HiGarfield/lede-17.01.4-Mod that referenced this issue Aug 17, 2022
@ynezz @HiGarfield
zlib: backport null dereference fix
9157d23 
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 7df6795d4c25 ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.

References: curl/curl#9271
Fixes: 7df6795d4c25 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
HiGarfield pushed a commit to HiGarfield/lede-17.01.4-Mod that referenced this issue Aug 17, 2022
@ynezz @HiGarfield
zlib: backport null dereference fix
fa1d393 
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 7df6795d4c25 ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.

References: curl/curl#9271
Fixes: 7df6795d4c25 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
@tobijk tobijk mentioned this issue Aug 19, 2022
Closed
@jaymehta6
Copy link

Please provide runtests.pl file to run the exploit.

@jaymehta6
Copy link

jaymehta6 commented Aug 22, 2022 •
edited
Loading

I did this

Using zlib v1.2.12 patched for CVE-2022-37434:

make test
# or...
cd tests
./runtests.pl 224

test 0224...[HTTP GET gzip compressed content with huge comment and extra field]

 224: data FAILED:
--- log/check-expected	2022-08-07 23:29:39.568010972 +0000
+++ log/check-generated	2022-08-07 23:29:39.568010972 +0000
@@ -1,9 +0,0 @@
-HTTP/1.1 200 OK[CR][LF]
-Date: Mon, 29 Nov 2004 21:56:53 GMT[CR][LF]
-Server: Apache/1.3.31 (Debian GNU/Linux) mod_gzip/1.3.26.1a PHP/4.3.9-1 mod_ssl/2.8.20 OpenSSL/0.9.7d mod_perl/1.29[CR][LF]
-Vary: Accept-Encoding[CR][LF]
-Content-Type: text/html; charset=ISO-8859-1[CR][LF]
-Content-Encoding: gzip[CR][LF]
-Content-Length: 2186[CR][LF]
-[CR][LF]
-uncompressed gzip data with long gzip header[LF]

I've also seen this test failure accompanied by a segfault, but this only happens within a sandbox (which uses the Linux kernel's namespacing feature):

test 0224...core dumped
FAILED

I expected the following

For the test to succeed.

curl/libcurl version

7.84.0

operating system

Linux 5.15.43 #1-NixOS SMP Wed May 25 12:42:07 UTC 2022 aarch64 GNU/Linux

This very much could be a zlib issue since the patch in question hasn't made it into a release yet, but I'm going to leave this open just in case it's not; feel free to close.

@winterqt ### Please provide runtests.pl file to run the exploit.

@bagder
Copy link
Member

bagder commented Aug 22, 2022

This crash happened using the regular curl test suite. The files are in the git repository.

But please, this issue is not a curl issue and it is closed.

devendranaga pushed a commit to devendra-naga-labs/bsp_build that referenced this issue Sep 8, 2022
@ynezz @devendranaga
zlib: backport null dereference fix
fd28b5a 
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 7df6795 ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.

References: curl/curl#9271
Fixes: 7df6795 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
pedro0311 added a commit to pedro0311/freshtomato-arm that referenced this issue Sep 23, 2022
@pedro0311
zlib: backport null dereference fix
b637c1e 
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 7df6795 ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.

References: curl/curl#9271
Fixes: 7df6795 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
pedro0311 added a commit to pedro0311/freshtomato-mips that referenced this issue Sep 23, 2022
@pedro0311
zlib: backport null dereference fix
d50475c 
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 7df6795 ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.

References: curl/curl#9271
Fixes: 7df6795 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
@Neustradamus
Copy link

@madler has done the new build, the 1.2.13 has been released with the CVE-2022-37434 fix.

ArtelMike pushed a commit to ArtelMike/openwrt-1 that referenced this issue Jan 31, 2023
@ynezz
zlib: backport null dereference fix
f1ad0cd 
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 66dd6bc ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.

References: curl/curl#9271
Fixes: 66dd6bc ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 6a1b277)
(cherry picked from commit 189c51c)
ohabu pushed a commit to ohabu/openwrt that referenced this issue May 12, 2023
@ynezz @ohabu
zlib: backport null dereference fix
a2678c2 
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 7df6795 ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.

References: curl/curl#9271
Fixes: 7df6795 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit f443e9d)
(cherry picked from commit 707ec48)
sergoops pushed a commit to sergoops/openwrt_tl_wr840n_v6.x that referenced this issue Nov 18, 2023
@ynezz @sergoops
zlib: backport null dereference fix
5f8aac7 
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 7df6795 ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.

References: curl/curl#9271
Fixes: 7df6795 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit f443e9d)
(cherry picked from commit 707ec48)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@bagder bagder

Labels
crash not-a-curl-bug This is not a bug in curl tests
Milestone
No milestone
Development

No branches or pull requests
5 participants
@Neustradamus @bagder @madler @jaymehta6 @winterqt