NetBSD Problem Report #59505

From kimmo@suominen.org  Thu Jul  3 05:00:12 2025
Return-Path: <kimmo@suominen.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 44B151A923E
	for <gnats-bugs@gnats.NetBSD.org>; Thu,  3 Jul 2025 05:00:12 +0000 (UTC)
Message-Id: <20250703050001.D90351077B@revolutions.gw.fi>
Date: Thu, 03 Jul 2025 08:00:01 +0300 (EEST)
From: kim@netbsd.org (Kimmo Suominen)
To: gnats-bugs@NetBSD.org
Subject: CVE-2025-31115: Threaded .xz decoder frees memory too early
X-Send-Pr-Version: 3.95

>Number:         59505
>Category:       lib
>Synopsis:       CVE-2025-31115: Threaded .xz decoder frees memory too early
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    lib-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jul 03 05:05:00 +0000 2025
>Originator:     Kimmo Suominen
>Release:        NetBSD 10.99.14 (202505302330Z)
>Organization:
>Environment:
System: NetBSD revolutions.gw.fi 10.99.14 NetBSD 10.99.14 (GENERIC) #0: Fri May 30 19:42:28 UTC 2025 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64
Architecture: x86_64
Machine: amd64
>Description:

	In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder
	in liblzma has a bug where invalid input can at least result
	in a crash (CVE-2025-31115). The effects include heap use
	after free and writing to an address based on the null pointer
	plus an offset. Applications and libraries that use the
	lzma_stream_decoder_mt function are affected.

>How-To-Repeat:

	https://tukaani.org/xz/threaded-decoder-early-free.html

>Fix:

	Upgrade to 5.8.1 (or later).

Home	PR Database Search