CVE-2016-6580

Memory Exhaustion Vulnerability in Python Priority Library

• CVSS 7.5
• CWE-399: Resource Management Errors
• Resource Management
• Remote

A HTTP/2 implementation built using any version of the Python priority library prior to version 1.2.0 could be targeted by a malicious peer by having that peer assign priority information for every possible HTTP/2 stream ID. The priority tree would happily continue to store the priority information for each stream, and would therefore allocate unbounded amounts of memory. Attempting to actually use a tree like this would also cause extremely high CPU usage to maintain the tree.

CVE

CVE-2016-6580

CWE

CWE-399: Resource Management Errors

CVSS base score

7.5

Published

2017-01-10

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update Python priority library to version 1.2.0 or higher.

import h2.connection
conn = h2.connection.H2Connection()
conn.initiate_connection()
conn.send_headers(1, [(':method', 'GET'), (':path', '/'), (':scheme', 'https'), (':authority', 'example.com')])
conn.receive_data(server_data)

class PriorityTree:
    def __init__(self):
        self.tree = {}
        self.max_streams = 100

    def add_stream(self, stream_id, priority):
        if len(self.tree) >= self.max_streams:
            raise MemoryError("Maximum number of streams reached. Cannot add more.")
        self.tree[stream_id] = priority

    def get_priority(self, stream_id):
        return self.tree.get(stream_id, None)

if __name__ == "__main__":
    priority_tree = PriorityTree()

    try:
        for i in range(150):
            priority_tree.add_stream(i, priority=i)

    except MemoryError as e:
        print("Error:", e)

@misc{vaitp:cve20166580,
  title        = {{Memory Exhaustion Vulnerability in Python Priority Library}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2017},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2016-6580},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2016-6580/}}
}