Can you upload the zip file you used to generate the issue please? ________________________________ From: Akhil Koul <[email protected]> Sent: 27 July 2026 19:08 To: [email protected] <[email protected]> Subject: Bug#1142904: unzip: heap OOB read in EF_IZUNIX3 extra field handler [CAN-2026-2034440]
Package: unzip Version: 6.0-28 Severity: grave Tags: security X-Debbugs-Cc: [email protected], [email protected] Hi, InfoZIP unzip 6.0 contains a heap out-of-bounds read in the ef_scan_for_izux() function in process.c when processing EF_IZUNIX3 (ID 0x7875) extra field blocks. This is a missed variant of CVE-2014-8139 — that fix addressed the EF_IZUNIX (0x5855) and EF_IZUNIX2 (0x7855) handlers but did NOT patch the EF_IZUNIX3 (0x7875) handler. CAN: CAN-2026-2034440 (pending assignment from MITRE) CWE: CWE-125 (Out-of-bounds Read) CVSS: 6.1 Medium ROOT CAUSE (process.c, line 2988): uid_size = *((EB_HEADSIZE + 1) + ef_buf); gid_size = *((EB_HEADSIZE + uid_size + 2) + ef_buf); // OOB READ The only validation is `eb_len >= EB_UX3_MINLEN` (i.e., eb_len >= 7). uid_size is attacker-controlled (a byte value 0-255, read from ef_buf at a fixed offset). With uid_size=200 and eb_len=7, the gid_size read at offset (EB_HEADSIZE + 200 + 2) = 206 reads 199 bytes past the end of the 7-byte extra field data. The subsequent read_ux3_value() calls at offsets (EB_HEADSIZE + 2) and (EB_HEADSIZE + uid_size + 3) compound the over-read. TRIGGER: unzip -o poc.zip (extraction mode) where poc.zip contains a file entry with an EF_IZUNIX3 extra field block with eb_len=7 and uid_size=200. ASAN OUTPUT (Debian unzip 6.0, built with -fsanitize=address -DIZ_HAVE_UXUIDGID): ==12==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xffffafe007de at pc 0xaaaae3888d50 READ of size 1 at 0xffffafe007de thread T0 #0 ef_scan_for_izux /build/unzip-6.0/process.c:2988:28 #1 get_extattribs /build/unzip-6.0/unix/unix.c:1063:36 #2 close_outfile /build/unzip-6.0/unix/unix.c:1115:23 #3 extract_or_test_member /build/unzip-6.0/extract.c:2122:9 #4 extract_or_test_entrylist /build/unzip-6.0/extract.c:1748:22 #5 extract_or_test_files /build/unzip-6.0/extract.c:741:17 IMPACT: Heap OOB read causing crash (DoS). The OOB-read value is used as a UID for chown() on the extracted file, so an attacker can also influence file ownership. Active on all distributions that compile with -DIZ_HAVE_UXUIDGID (Debian, Ubuntu, Red Hat, SUSE). SUGGESTED FIX (add bounds checks matching the CVE-2014-8139 pattern): uid_size = *((EB_HEADSIZE + 1) + ef_buf); + if (uid_size + 3 > eb_len) + break; gid_size = *((EB_HEADSIZE + uid_size + 2) + ef_buf); + if (uid_size + gid_size + 3 > eb_len) + break; Best regards, Akhil Koul
