File size: 1,627 Bytes
cc0dd17 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 | # PoC: Uncontrolled Recursion in Avro Schema Parsing → Process Crash (SIGSEGV)
**Affected:** `avro` (Apache Avro Python package) 1.12.1
**Vulnerability class:** CWE-674 (Uncontrolled Recursion)
## What this repo contains
`malicious_schema.avsc` — a valid-syntax Avro schema file, 8,756 bytes,
consisting of 350 nested `"array"` type wrappers around a base `"long"`
type. Every individual level is syntactically valid Avro; only the
nesting depth is abusive.
## How to reproduce
```bash
pip install avro
python3 reproduce.py
```
On an affected system, this crashes the Python process with SIGSEGV
(exit code 139 / "Segmentation fault") — not a caught Python
exception — when the schema is parsed on a thread with a reduced
stack size (256KB, the standard default greenlet stack size used by
`gevent`/`eventlet`, common in async Kafka/AMQP consumer deployments
written in Python).
On a default (full-size) thread stack, the same file only produces a
catchable `RecursionError` — the crash specifically requires the
reduced-stack execution context, which is realistic but not
universal. See the full report for details.
## Why this matters
Any Python service that (a) accepts externally-supplied Avro schemas
(e.g. a Kafka consumer that reads schema definitions from message
metadata or a schema registry) and (b) runs on a
`gevent`/`eventlet`-style worker, can have its entire worker process
crashed by a single ~9KB malicious schema — not just the one message
being processed.
Full write-up, environment details, threshold measurements, and
suggested remediation are in the accompanying disclosure report.
|