http://bugzilla.suse.com/show_bug.cgi?id=1064286 http://bugzilla.suse.com/show_bug.cgi?id=1064286#c2 Jan Matejek changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |security-team@suse.de Summary|libxml2-python segfault |libxml2-python segfault |when building gtk-doc with |after doc.freeDoc() |itstool 2.0.4 | Flags| |needinfo?(security-team@sus | |e.de) Severity|Normal |Major --- Comment #2 from Jan Matejek --- Here's a reproducer. cc security team: guys, I suspect that this might be exploitable if someone were to do a use-after-free bug with libxml2-python in a python web app? (Not sure if we care, I don't know any web apps that use libxml2-python, much less ones that have an undiscovered use-after-free bug.) --------8<-------- cat > repro.py < tst.xml < --------8<-------- expected output: something roughly like: --------8<-------- $ python repro.py <?xml version="1.0"?> <doc><foo/></doc> Traceback (most recent call last): File "libxml.py", line 5, in <module> raise Exception("attempting to access freed document") Exception: attempting to access freed document --------8<-------- -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1064286 http://bugzilla.suse.com/show_bug.cgi?id=1064286#c4 Matthias Gerstner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |matthias.gerstner@suse.com Flags|needinfo?(security-team@sus | |e.de) | --- Comment #4 from Matthias Gerstner --- Hi Jan, sorry for the late reply - and thank you for your excellent work analysing this. I can currently reproduce the segmentation fault only on Leap 42.2. On 42.3 the `doc` object ends up as `` and can safely be accessed. I don't know if this was improved by a recent change in python, libxml2 or libxml2-python. It seems that libxml2-python is only a thin layer around libxml2 and puts burdens of memory management onto the python programmer. So it seems somewhat "by design" and a bad idea to access libxml2-python objects after they've been freed. This is what is suggested by this older mailing list post: https://mail.gnome.org/archives/xml/2010-April/msg00001.html Technically you're correct that this can open up a use after free situation. Given the unpythonic interface of libxml2-python I'd say it's a bad idea to use it for any security sensitive setups. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1064286 Petr Gajdos changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mcepl@suse.com -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1064286 http://bugzilla.suse.com/show_bug.cgi?id=1064286#c7 --- Comment #7 from Petr Gajdos --- Created attachment 775685 --> http://bugzilla.suse.com/attachment.cgi?id=775685&action=edit valgrind errors for reproducer -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1064286 http://bugzilla.suse.com/show_bug.cgi?id=1064286#c9 --- Comment #9 from Petr Gajdos --- Reading comment 4, I would just perhaps notify upstream of libxml2 (if something at all) and otherwise consider this bug fixed by sr#535476. Would, you agree, Matěj? -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1064286 http://bugzilla.suse.com/show_bug.cgi?id=1064286#c14 --- Comment #14 from Petr Gajdos --- Thanks Matej for the upstream report. -- You are receiving this mail because: You are on the CC list for the bug.