libsolv Stack-Based Buffer Overflow Vulnerability in PGP Verification Component Allows Denial-of-Service

A stack-based buffer overflow vulnerability has been identified in the libsolv library, specifically within the PGP verification component. This vulnerability arises from improper length handling when copying the EdDSA 's' MPI into a stack buffer. A remote attacker could exploit this flaw by crafting a malicious Ed25519 PGP signature with mismatched MPI lengths. When this signature is processed, it could lead to a denial-of-service condition in automated package or repository processing workflows.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, which is likely to crash the application. However, such buffer overflows can often be exploited to execute arbitrary code, potentially leading to more severe consequences.

Reproduction

The vulnerability can be reproduced by building libsolv with the PGP verification feature enabled, and then using the 'solv_pgpvrfy' function to verify a crafted Ed25519 signature that exploits the length handling flaw. This can be done by creating a signature with a 's' MPI length that is intentionally mismatched, causing the verification process to overwrite memory beyond the allocated buffer.

Remediation

Users should update to libsolv version 0.7.38 or later, where this vulnerability has been fixed.