CVE-2019-12410

UBSAN errors in Apache Arrow 0.12.0-0.14.1 left uninitialized memory when reading RLE null data from Parquet

• CVSS 7.5
• CWE-909 Missing Initialization of Resource
• Input Validation and Sanitization
• Remote

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.

CVE

CVE-2019-12410

CWE

CWE-909 Missing Initialization of Resource

CVSS base score

7.5

Published

2019-11-08

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update Apache Arrow to version 0.14.2 or higher.

import pyarrow as pa
import pyarrow.parquet as pq

def read_parquet_file(file_path):
    # VULNERABLE: This code is susceptible to path traversal
    table = pq.read_table(file_path)

    for column in table.columns:
        if pa.types.is_null(column.type):
            uninitialized_data = column.to_numpy()
            print(f"Column '{column.name}' data: {uninitialized_data}")

    return table

import pyarrow as pa
import pyarrow.parquet as pq

def read_parquet_file(file_path):
    # SECURE: This version prevents path traversal
    table = pq.read_table(file_path)

    for column in table.columns:
        if pa.types.is_null(column.type):
            table = table.set_column(table.schema.get_field_index(column.name), column.name, pa.array([None] * len(column)))

    return table

@misc{vaitp:cve201912410,
  title        = {{UBSAN errors in Apache Arrow 0.12.0-0.14.1 left uninitialized memory when reading RLE null data from Parquet}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2019-12410},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2019-12410/}}
}