[CVE-2022-24713] Denial of service in compiler with rust-regex

[Joshua Peisach]

There is a denial of service in rust-regex. Below is an SRU template to prepare for patching CVE-2022-24713.

[Impact]

 * The rust compile can compile a regex an empty sub-expression as many times as wanted.
 * Take '(?:){294967295}' - this would make the regex compiler compile 294967295 times.
 * This results in a denial of service; there wouldnt be a crash but the compiler would take forever and eventually get there.
 * An attacker could use this amount of time it takes for the compiler to parse this regex to perform DoS attacks

[Test Plan]

 * Take a regex from the regex crate that is still vulnerable - get pre 1.5.5.
 * Use one of the test cases provided in the fix commit https://github.com/rust-lang/regex/commit/ae70b41d4f46641dbc45c7a4f87954aea356283e or use this POC i made: https://github.com/ItzSwirlz/CVE-2022-24713-POC
 * Building using the old regex would take forever, but the fix would take a shorter time.

[Where problems could occur]

 * An integer overflow might still be able to cause a regex overload
 * Changes to the rust libraries/packages and other SRUs may create regressions with updates that may outdate the library

 * This fix adds a fake amount of memory any time a regex empty sub-expression is compiiled, and then adds to the Inst in the existing indirect heap usage.
 * This means maybe an attacker could overload the amount of Regex's and make compiling impossible? Memory may be lost in very specific situations, or a heap buffer issue can occur

[Other Info]

 * Impacts Focal, Impish, Jammy

 * Links:
   https://github.com/rust-lang/regex/commit/ae70b41d4f46641dbc45c7a4f87954aea356283e
   https://blog.rust-lang.org/2022/03/08/cve-2022-24713.html
   https://ubuntu.com/security/CVE-2022-24713
   https://github.com/rust-lang/regex/security/advisories/GHSA-m5pq-gvj9-9vr8

ProblemType: Bug
DistroRelease: Ubuntu 22.04
Package: librust-regex-dev 1.5.4-1
ProcVersionSignature: Ubuntu 5.15.0-30.31-generic 5.15.30
Uname: Linux 5.15.0-30-generic x86_64
ApportVersion: 2.20.11-0ubuntu82.1
Architecture: amd64
CasperMD5CheckMismatches: ./casper/filesystem.manifest-remove
CasperMD5CheckResult: fail
CurrentDesktop: Unity:Unity7:ubuntu
Date: Sun Jun 5 18:26:32 2022
InstallationDate: Installed on 2022-04-22 (44 days ago)
InstallationMedia: Ubuntu Unity 22.04
RebootRequiredPkgs: Error: path contained symlinks.
SourcePackage: rust-regex
UpgradeStatus: No upgrade log present (probably fresh install)

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "Proposed Jammy Patch" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Joshua Peisach (itzswirlz)]

Ubuntu Kinetic - Fixed from Debian release 1.55.5-1

rust-regex (1.5.5-1) unstable; urgency=medium

  * Package regex 1.5.5 from crates.io using debcargo 2.5.0
  * Fixes a security issue - CVE-2022-24713 (Closes: #1007176)

 -- Sylvestre Ledru <email address hidden> Wed, 16 Mar 2022 10:33:32 +0100

[Eduardo Barretto (ebarretto)]

Hi Joshua,

Thanks for taking the time and providing this debdiff!
My colleague David will be taking a look at it.

[Joshua Peisach (itzswirlz)]

Hi guys, FYI I did not receive a notification/update when rust-regex was pushed to security proposed. But no problem; when I get back from vacation I'll test it.

[David Fernandez Gonzalez (litios)]

Hi, we didn't make any announcement about it because we are still working on the approach to take to rebuild the packages affected by this update. That's why we only have published the update under proposed but please, any testing you can perform is very welcome. We will provide any updates on this asap. Thank you.

[Joshua Peisach (itzswirlz)]

No problem! I tested Focal and indeed the patch works.

[Launchpad Janitor (janitor)]

This bug was fixed in the package rust-regex - 1.5.4-1ubuntu0.1

---------------
rust-regex (1.5.4-1ubuntu0.1) jammy-security; urgency=high

  * SECURITY UPDATE: fix denial-of-service bug in compiler
    (CVE-2022-24713) (LP: #1977694)

 -- Joshua Peisach <email address hidden> Sun, 05 Jun 2022 16:36:11 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package rust-regex - 1.2.1-3ubuntu0.1

---------------
rust-regex (1.2.1-3ubuntu0.1) focal-security; urgency=medium

  * SECURITY UPDATE: fix denial-of-service bug in compiler (LP: #1977694)
    - debian/patches/CVE-2022-24713-pre.patch: support empty patterns
    in src/compile.rs.
    - debian/patches/CVE-2022-24713-pre2.patch: account for Unicode
    class size in regex compilation error in src/compile.rs.
    - debian/patches/CVE-2022-24713.patch: adding a fake amount of
    memory every time we compile an empty sub-expression in
    src/compile.rs.
    - CVE-2022-24713

 -- David Fernandez Gonzalez <email address hidden> Tue, 21 Jun 2022 09:14:36 -0500

[David Fernandez Gonzalez (litios)]

Updates for focal and jammy released. More information here: https://ubuntu.com/security/notices/USN-5610-1

The following related packages have been rebuilt to include the security update:

* rust-bat
* rust-bindgen
* rust-debcargo
* rust-dfrs
* rust-fd-find
* rust-hyperfine
* rust-lalrpop
* rust-markdown
* rust-pleaser
* rust-ripgrep
* rust-rustfilt
* rust-sequoia-keyring-linter
* rust-sequoia-sop
* rust-sequoia-sq
* rust-sniffglue
* rust-ucd-generate

[Joshua Peisach (itzswirlz)]

Sorry for being slow - thanks for releasing!