CVE-2014-4616: Out-of-bounds Read
Array index error in the scanstring function in the json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the rawdecode function.
Other sources
It was reported [1] that Python built-in json module have a flaw (insufficient bounds checking), which allows a local user to read current process' arbitrary memory.
Quoting the upstream bug report: ... The sole prerequisites of this attack are that the attacker is able to control or influence the two parameters of the default scanstring function: the string to be decoded and the index.
The bug is caused by allowing the user to supply a negative index value. The index value is then used directly as an index to an array in the C code; internally the address of the array and its index are added to each other in order to yield the address of the value that is desired. However, by supplying a negative index value and adding this to the address of the array, the processor's register value wraps around and the calculated value will point to a position in memory which isn't within the bounds of the supplied string, causing the function to access other parts of the process memory. ...
Upstream bug report with additional technical details: [1] http://bugs.python.org/issue21529
Upstream commits (taken from upstream tracker):
2.7: http://hg.python.org/cpython/rev/50c07ed1743d 3.1: http://hg.python.org/cpython/rev/a8facac493ef 3.2: http://hg.python.org/cpython/rev/8130b8c06606 3.3: http://hg.python.org/cpython/rev/4f15bd1ab28f 3.4: http://hg.python.org/cpython/rev/7b95540ced5c 3.5: http://hg.python.org/cpython/rev/3a414c709f1f
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4616?
CVE-2014-4616 has a medium severity due to the potential for context-dependent memory exposure.
How do I fix CVE-2014-4616?
To fix CVE-2014-4616, update Python to version 2.7.7 or later, or to 3.3.6 or later.
What versions of Python are affected by CVE-2014-4616?
CVE-2014-4616 affects Python versions from 2.7.0 to 2.7.3, and 3.0.0 to 3.4.0.
Is Simplejson affected by CVE-2014-4616?
Yes, Simplejson versions before 2.6.1 are affected by CVE-2014-4616.
What impact does CVE-2014-4616 have on system security?
CVE-2014-4616 may allow attackers to read arbitrary process memory, potentially exposing sensitive data.