Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 11 Jun 2016 09:50:17 +0200
From: Tobias Stoeckmann <>
Subject: CVE Request for Denial of Service in pacman 5.0.1

The package manager of Arch Linux, pacman, is vulnerable to a denial of
service attack based on signature files. This issue is located in libalpm
and therefore affects any other frontend of it, too.

A malicious signature file can trigger an out of bondary read on 32 and
64 bit systems, but also leads to an endless loop on 32 bit system.

While an endless loop on itself is no security issue per-se, such a
crafted file might trick the end-user to disable signature verification
to get his updates installed. This, on the other hand, would open up
possibilities for malicious packages to be installed.

Therefore, this DoS can be considered a stepping stone towards a system

Proof of concept (signature verification must be enabled):

$ uname -m
$ PKG=package-1.0.tar.xz
$ touch $PKG
$ echo "iQEcBAABCAAGBQJXTxJiAAr/////+wA=" | base64 -d - > $PKG.sig
$ sudo pacman -U $PKG

The out of boundary access can be used to send 8 bytes inside the
address space of a root-running program to a keyserver, as long as the
byte in front of them is 0x10.

This issue with a patch has been reported upstream. [1]

Can you assign a CVE-ID for this?



Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.