Hi,
InfoZIP unzip 6.0 contains a heap out-of-bounds read in the
ef_scan_for_izux() function in process.c when processing EF_IZUNIX3
(ID 0x7875) extra field blocks. This is a missed variant of
CVE-2014-8139 — that fix addressed the EF_IZUNIX (0x5855) and
EF_IZUNIX2 (0x7855) handlers but did NOT patch the EF_IZUNIX3 (0x7875)
handler.
CAN: CAN-2026-2034440 (pending assignment from MITRE)
CWE: CWE-125 (Out-of-bounds Read)
CVSS: 6.1 Medium
ROOT CAUSE (process.c, line 2988):
uid_size = *((EB_HEADSIZE + 1) + ef_buf);
gid_size = *((EB_HEADSIZE + uid_size + 2) + ef_buf); // OOB READ
The only validation is `eb_len >= EB_UX3_MINLEN` (i.e., eb_len >= 7).
uid_size is attacker-controlled (a byte value 0-255, read from ef_buf
at a fixed offset). With uid_size=200 and eb_len=7, the gid_size read
at offset (EB_HEADSIZE + 200 + 2) = 206 reads 199 bytes past the end
of the 7-byte extra field data. The subsequent read_ux3_value() calls
at offsets (EB_HEADSIZE + 2) and (EB_HEADSIZE + uid_size + 3) compound
the over-read.
TRIGGER: unzip -o poc.zip (extraction mode) where poc.zip contains a
file entry with an EF_IZUNIX3 extra field block with eb_len=7 and
uid_size=200.
ASAN OUTPUT (Debian unzip 6.0, built with -fsanitize=address
-DIZ_HAVE_UXUIDGID):
==12==ERROR: AddressSanitizer: heap-buffer-overflow on address
0xffffafe007de at pc 0xaaaae3888d50
READ of size 1 at 0xffffafe007de thread T0
#0 ef_scan_for_izux /build/unzip-6.0/process.c:2988:28
#1 get_extattribs /build/unzip-6.0/unix/unix.c:1063:36
#2 close_outfile /build/unzip-6.0/unix/unix.c:1115:23
#3 extract_or_test_member /build/unzip-6.0/extract.c:2122:9
#4 extract_or_test_entrylist /build/unzip-6.0/extract.c:1748:22
#5 extract_or_test_files /build/unzip-6.0/extract.c:741:17
IMPACT: Heap OOB read causing crash (DoS). The OOB-read value is used
as a UID for chown() on the extracted file, so an attacker can also
influence file ownership. Active on all distributions that compile with
-DIZ_HAVE_UXUIDGID (Debian, Ubuntu, Red Hat, SUSE).
SUGGESTED FIX (add bounds checks matching the CVE-2014-8139 pattern):
uid_size = *((EB_HEADSIZE + 1) + ef_buf);
+ if (uid_size + 3 > eb_len)
+ break;
gid_size = *((EB_HEADSIZE + uid_size + 2) + ef_buf);
+ if (uid_size + gid_size + 3 > eb_len)
+ break;
Best regards,
Akhil Koul
Can you upload the zip file you used to generate the issue please?
Can you upload the zip file you used to generate the issue please?
This issue is already fixed in the development sources for unzip. Patch enclosed.
Hi Paul, PoC zip attached (poc_ef_izunix3_oob.zip). Trigger: unzip -o poc_ef_izunix3_oob.zip It contains a file entry with an EF_IZUNIX3 extra field (ID 0x7875) where eb_len=7 (minimum valid) and uid_size=200. The gid_size read at offset (EB_HEADSIZE + 200 + 2) = 206 goes 199 bytes past the 7-byte field data. Under ASan: ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1 at ef_scan_for_izux process.c:2988 You mentioned this is already fixed in dev sources — glad to hear it. If the patch is the same bounds check I suggested (uid_size + 3 > eb_len), that should cover it. Best, Akhil
This is the patch that I've included in the Debian list. It comes from the latest dev sources.
diff --git a/process.c b/process.c
index b385f1e..a03a813 100644
--- a/process.c
+++ b/process.c
@@ -2987,7 +2987,7 @@ unsigned ef_scan_for_izux(ef_buf, ef_len, ef_is_c, dos_mdatetime,
have_new_type_eb = 2;
/* Ignore any prior EF_IZUNIX/EF_PKUNIX/EF_IZUNIX2 UID/GID. */
- flags &= 0x0ff;
+ flags &= EB_UT_FL_TIMES;
/*
Version 1 byte version of this extra field, currently 1
UIDSize 1 byte Size of UID field
@@ -2995,29 +2995,46 @@ unsigned ef_scan_for_izux(ef_buf, ef_len, ef_is_c, dos_mdatetime,
GIDSize 1 byte Size of GID field
GID Variable GID for this entry
*/
-
-#ifdef IZ_HAVE_UXUIDGID
- if (eb_len >= EB_UX3_MINLEN
- && z_uidgid != NULL
- && (*((EB_HEADSIZE + 0) + ef_buf) == 1))
- /* only know about version 1 */
+# ifdef IZ_HAVE_UXUIDGID
+ /* Check for a legitimate extra block length, a non-NULL
+ * destination pointer, and "ux" version 1 (which is all we
+ * understand).
+ */
+ if ((eb_len >= EB_UX3_MINLEN) &&
+ (z_uidgid != NULL) &&
+ (*((EB_HEADSIZE + 0) + ef_buf) == 1))
{
- uch uid_size;
- uch gid_size;
+ /* 2012-12-07 SMS. (OUSPG report.)
+ * First, clear "flags". Then, check the validity of
+ * uid_size before using it to find gid_size.
+ * Made Xid_size bigger than "uch" for safer arithmetic.
+ */
+ unsigned uid_size;
+ unsigned gid_size;
uid_size = *((EB_HEADSIZE + 1) + ef_buf);
- gid_size = *((EB_HEADSIZE + uid_size + 2) + ef_buf);
- if ( read_ux3_value((EB_HEADSIZE + 2) + ef_buf,
- uid_size, &z_uidgid[0])
- &&
- read_ux3_value((EB_HEADSIZE + uid_size + 3) + ef_buf,
- gid_size, &z_uidgid[1]) )
+ /* Valid: 1 (Version) + 1 (UIDSize) + UIDSize +
+ * 1 (GIDSize) + 2 (min GIDSize) <= eb_len.
+ */
+ if (5+ uid_size <= eb_len)
{
- flags |= EB_UX2_VALID; /* signal success */
+ gid_size = *((EB_HEADSIZE + uid_size + 2) + ef_buf);
+
+ /* Last, check total claimed xID sizes against eb_len. */
+ if (3+ uid_size+ gid_size == eb_len)
+ {
+ if (read_ux3_value( (EB_HEADSIZE + 2) + ef_buf,
+ uid_size, &z_uidgid[0]) &&
+ read_ux3_value( (EB_HEADSIZE + uid_size + 3) + ef_buf,
+ gid_size, &z_uidgid[1]))
+ {
+ flags |= EB_UX2_VALID; /* signal success */
+ }
+ }
}
}
-#endif /* IZ_HAVE_UXUIDGID */
+# endif /* def IZ_HAVE_UXUIDGID */
break;
case EF_IZUNIX:
diff --git a/unzpriv.h b/unzpriv.h
index 297b3c7..a44fb9f 100644
--- a/unzpriv.h
+++ b/unzpriv.h
@@ -1788,6 +1788,7 @@
#define EB_UT_FL_MTIME (1 << 0) /* mtime present */
#define EB_UT_FL_ATIME (1 << 1) /* atime present */
#define EB_UT_FL_CTIME (1 << 2) /* ctime present */
+# define EB_UT_FL_TIMES 0xff /* Mask for all time flag bits. */
#define EB_FLGS_OFFS 4 /* offset of flags area in generic compressed
extra field blocks (BEOS, MAC, and others) */
We believe that the bug you reported is fixed in the latest version of
unzip, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1142904@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Santiago Vila <sanvila@debian.org> (supplier of updated unzip package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 01 Aug 2026 11:50:00 +0200
Source: unzip
Architecture: source
Version: 6.0-30
Distribution: unstable
Urgency: medium
Maintainer: Santiago Vila <sanvila@debian.org>
Changed-By: Santiago Vila <sanvila@debian.org>
Closes: 1142904 1142905
Changes:
unzip (6.0-30) unstable; urgency=medium
.
* Stop prefixing patch filenames with numbers.
* Fix invalid DEP3 metadata.
* Apply upstream fix for CAN-2026-2034440. Closes: #1142904.
(heap out-of-bounds read in EF_IZUNIX3 extra field handler)
* Apply upstream fix for CAN-2026-2034443. Closes: #1142905.
(stack out-of-bounds NUL write in EF_SMARTZIP handler)
* Drop "Rules-Requires-Root: no" (default).
* Drop "Priority: optional" (default).
* Update standards-version.
* Disable redundant/duplicate Salsa CI jobs.
* Drop no longer needed lintian override.
Checksums-Sha1:
276d42f4df3953c67e832c6b4ad4cbec1d746412 1463 unzip_6.0-30.dsc
7ad53fb776af0dec6b0ef277b1636dbe9290ca65 26948 unzip_6.0-30.debian.tar.xz
b5adf28f817ae327fe3aa91b381eac57debc700c 5416 unzip_6.0-30_source.buildinfo
Checksums-Sha256:
7ba160de9860d197ae42fb8c574e098692e320c3ee61a75616df68f47481cc9f 1463 unzip_6.0-30.dsc
c63a485e25b61a87ccd62915579d38a6f37823018a1267f354f25161bdb96632 26948 unzip_6.0-30.debian.tar.xz
75f44c3f1bf92dc2ac47e2b5cf0ea1e4c4b38ec3facd30348571e8aba9380f3f 5416 unzip_6.0-30_source.buildinfo
Files:
00c7c52eabe1014a46cff1bebe80be29 1463 utils optional unzip_6.0-30.dsc
7f95a3d99c1db0fc1b2b51b8f91cfa02 26948 utils optional unzip_6.0-30.debian.tar.xz
07ac7ff5eb8debf012daed911055274d 5416 utils optional unzip_6.0-30_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEE1Uw7+v+wQt44LaXXQc5/C58bizIFAmptwowACgkQQc5/C58b
izInsQf+JsTMzfbd+AzfQuEc7cwDQEZ5674XIrqAAcLehQ0Wim6afSxkD19YMf8b
+rsUN3MBqLsugNY1aNJKUsy4r7UVrPcaLCTFk5qcXO6c6dF7E8sI7DK69CygQrIx
qc8MDNxwjnG/nYh7Ape/WFImbkHs4nsHdg9PR1GzxqzlJEWPku12rSvv3YJAfqbv
WcLfEVm9W2biXB7lYm/PD5KSwGkkEFr8bmitz9KywTTghPiHMgcAQm3wlojxG1/w
7yWIRbPbkVYu8u8Tsem0EBQlCJ6TD2Bl1GgXGpmyDFj1eA2QRAwokrmU0GOP2P0W
wa/5SCXTVk79nAf3iFxqaS88jIR/yw==
=Ta+a
-----END PGP SIGNATURE-----
We believe that the bug you reported is fixed in the latest version of
unzip, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1142904@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Santiago Vila <sanvila@debian.org> (supplier of updated unzip package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 11 Aug 2026 00:10:00 +0200
Source: unzip
Architecture: source
Version: 6.0-29+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Santiago Vila <sanvila@debian.org>
Changed-By: Santiago Vila <sanvila@debian.org>
Closes: 1142904 1142905 1142906
Changes:
unzip (6.0-29+deb13u1) trixie-security; urgency=high
.
* Apply upstream fix for CAN-2026-2034440. Closes: #1142904.
(heap out-of-bounds read in EF_IZUNIX3 extra field handler)
* Apply upstream fix for CAN-2026-2034443. Closes: #1142905.
(stack out-of-bounds NUL write in EF_SMARTZIP handler)
* Apply upstream fix for CAN-2026-2034442. Closes: #1142906.
(heap buffer overflow WRITE in memextract() STORED path)
Checksums-Sha1:
42334eabbc696974f21dfce2a68823e97a76a79c 1495 unzip_6.0-29+deb13u1.dsc
abf7de8a4018a983590ed6f5cbd990d4740f8a22 1376845 unzip_6.0.orig.tar.gz
e454737ecda044fbfa4172f282d1b437a1257939 27112 unzip_6.0-29+deb13u1.debian.tar.xz
1ce8d3add1e144124cab87b7f2e804724f76fc4c 5108 unzip_6.0-29+deb13u1_source.buildinfo
Checksums-Sha256:
b700df33b987c07f3d6435b175e0c2c924368d8c6e4efdcd2adf730ed69d4405 1495 unzip_6.0-29+deb13u1.dsc
036d96991646d0449ed0aa952e4fbe21b476ce994abc276e49d30e686708bd37 1376845 unzip_6.0.orig.tar.gz
32716adbdf903ee4e7e28f8c9884fc3459b22b2214e0ff4cefc0ab9839f43481 27112 unzip_6.0-29+deb13u1.debian.tar.xz
6466573510b0ef8bd825bfb980dbe4df9a9588872e56b75db0e8d94b7ae39348 5108 unzip_6.0-29+deb13u1_source.buildinfo
Files:
fb7b25488ed4028444633dc24fcb0e97 1495 utils optional unzip_6.0-29+deb13u1.dsc
62b490407489521db863b523a7f86375 1376845 utils optional unzip_6.0.orig.tar.gz
dba8d050188fd87fb9101e26d6eaed2f 27112 utils optional unzip_6.0-29+deb13u1.debian.tar.xz
edb182d881fbb2cc53f997d5a5d75125 5108 utils optional unzip_6.0-29+deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEE1Uw7+v+wQt44LaXXQc5/C58bizIFAmp68I0ACgkQQc5/C58b
izJEiAf/bD1tQ/7KrG3mEmaQ3XC8lcwayl+ACFgblKXXj0zKX5XX7D3i04gKiD8Q
0DrV9PQCfrMK+pLdCub69H+4kmUamP6Y+aGoLECy02nGdF9Akk87yAP5ZOUJgHrz
kPF5+Ts8kQl6/mDx+DKBI/hzWv2CylqIi80KXZb4i+dMdqIUDTgk7oY5/N7FtsNJ
FZ1BdCPxoRV4LTDbi6RHnxqdTFSJ1cvKtt7p0GqY6omYksMNWChHFNAFSfHVcb1Q
iD6bXmPnOu61srlvRBuZ0uDHaUvvwKzSf5cKSS1VkZjvhuNIcPa4GG41Vb39K6jr
A3QYWl5pT5cXn6ITJbYmxNaESIIMbg==
=A/a6
-----END PGP SIGNATURE-----