lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 7 Sep 2021 22:20:32 +0700
From: Antoine Martin <>
Subject: [FD] rencode 3-byte packet DoS

1) About Rencode
Rencode is a "Python module for fast (basic) object serialization
similar to bencode".
This library is used as a faster and more efficient data encoder than
There are implementations in other languages: Golang, Javascript, Java,
Ruby, dart, etc
Some of these ports carry the same bug, the Go port does.
(as an aside - not all of these derived works have preserved the
original copyright and license)

2) Vulnerability
Given malformed input, the rencode parser enters an infinite loop.
The shortest rencoded string to trigger this bug is ';\x2f\x7f' but
there is an infinite number of possibilities.
Although the library is accelerated in Cython, it cannot release the
global interpreter lock so the Python interpreter process is irreparably
locked up once the loop is entered.
The software becomes unresponsive and consumes CPU until the process
runs out of memory and is terminated - which can take a *very* long time.

3) Affected software
There are at least two active open-source network facing projects using
the vulnerable python rencode library in their transport layer: xpra and
Xpra is a remote desktop access tool - aka "screen for X11" and Deluge
is a bittorrent client.
There are other programs out there using this library but they are less
prominent or not network facing, though there may well be more
vulnerable software written in other languages.

4) Example DoS against xpra
Xpra uses rencode for structured messages between its processes,
typically between clients and servers.
Given an xpra process listening on a TCP port, sending this tiny (11
bytes) malformed packet triggers the DoS:
This does not require any authentication.
Some packaged installations create a system wide proxy server which runs
as root and listens on the IANA assigned TCP port 14500.
Other socket types don't make it any harder to trigger (ie: websockets,
SSL), only requiring extra packet encapsulation.
Local users may also have access to other user's unix domain sockets.

5) Mitigation
The easiest way is to remove the Cython accelerated version of rencode:
rm `python3 -c "from rencode import _rencode;print(_rencode.__file__)"`
As the pure Python fallback implementation does not have this bug.

6) Disclosure timeline
2021-08-05 bug discovered, fix provided
2021-08-06 requested a CVE from mitre
2021-08-10 fix applied in rencode
2021-09-07 disclosure

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists