[oss-security] [CVE-2024-8176] Long linear chains of entities crash Expat with stack overflow due to use of unlimited recursion

[Alan Coopersmith]

On 3/15/24 09:57, Alan Coopersmith wrote:

https://blog.hartwork.org/posts/expat-2-6-2-released/ (published 2024-03-13)
announces the release of Expat 2.6.2, with security fixes:

[...]

The blog also points to the call for help maintaining libexpat in the Changelog
at https://github.com/libexpat/libexpat/blob/R_2_6_2/expat/Changes which notes
that items that need someone to work on include:

!! - <blink>fixing a complex non-public security issue</blink>,              !!

Expat 2.7.0 has now been released with a fix for that issue, and the issue has
been disclosed in:
   https://blog.hartwork.org/posts/expat-2-7-0-released/
   https://github.com/libexpat/libexpat/issues/893
   https://github.com/libexpat/libexpat/pull/973

Jann Horn of Google Project Zero is credited with reporting the issue, while
Siemens is credited with making the fix, and Red Hat, Linutronix, and a company
that would not like to be named, are credited for helping test the fix.

The short summary from the bug report:

   A long linear chain of entity references: long enough to force the recursion
   in Expat into stack overflow.

   How long the chain needs to be depends on the stack size of the target
   machine. To illustrate the structure:

   # python3 payload1.py 2
   <!DOCTYPE doc [
     <!ENTITY e0 ''>
     <!ENTITY e1 '&e0;'>
     <!ENTITY e2 '&e1;'>
   ]>
   <doc>&e2;</doc>

   # python3 payload2.py 2
   <!DOCTYPE a [
     <!ENTITY e0 ''>
     <!ENTITY e1 '&e0;'>
     <!ENTITY e2 '&e1;'>
   ]>
   <a key='&e2;'/>

   # python3 payload3.py 2
   <!DOCTYPE doc [
     <!ENTITY % p0 ''>
     <!ENTITY % p1 '&#37;p0;'>
     <!ENTITY % p2 '&#37;p1;'>
     <!ENTITY % define_g0 "<!ENTITY g0 '&#37;p2;'>">
     %define_g0;
   ]>
   <doc/>

(The payload*.py scripts are linked from
 https://github.com/libexpat/libexpat/issues/893)

The blog requests that "you please tell your friends:

    Please leave recursion to math and keep it out of (in particular C)
    software: it kills and will kill again.
    Kind regards from libexpat, see CVE-2022-25313 and CVE-2024-8176 for proof."

--
        -Alan Coopersmith-                 alan.coopersm...@oracle.com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris