CVE Request for Denial of Service in pacman 5.0.1

[Tobias Stoeckmann <tobias () stoeckmann org>]

The package manager of Arch Linux, pacman, is vulnerable to a denial of
service attack based on signature files. This issue is located in libalpm
and therefore affects any other frontend of it, too.

A malicious signature file can trigger an out of bondary read on 32 and
64 bit systems, but also leads to an endless loop on 32 bit system.

While an endless loop on itself is no security issue per-se, such a
crafted file might trick the end-user to disable signature verification
to get his updates installed. This, on the other hand, would open up
possibilities for malicious packages to be installed.

Therefore, this DoS can be considered a stepping stone towards a system
attack.

Proof of concept (signature verification must be enabled):

$ uname -m
i686
$ PKG=package-1.0.tar.xz
$ touch $PKG
$ echo "iQEcBAABCAAGBQJXTxJiAAr/////+wA=" | base64 -d - > $PKG.sig
$ sudo pacman -U $PKG
_

The out of boundary access can be used to send 8 bytes inside the
address space of a root-running program to a keyserver, as long as the
byte in front of them is 0x10.

This issue with a patch has been reported upstream. [1]

Can you assign a CVE-ID for this?


--T.

[1] https://lists.archlinux.org/pipermail/pacman-dev/2016-June/021148.html