[CVE-2020-14422] Hash collisions in IPv4Interface and IPv6Interface

[marwenn02]

BPO	41004
Nosy	@jcea, @larryhastings, @ericvsmith, @ned-deily, @corona10, @miss-islington, @tapakund, @amiremohamadi, @Beuc, @marwenn02, @sreev, @rvteja92
PRs	bpo-41004: IPv4Interface, and IPv6Interface hash collisions  #20956 bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface #21033 [3.9] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033) #21220 [3.8] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033) #21221 [3.7] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interfac… #21231 [3.6] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6In… #21232 [3.5] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6In… #21233

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2020-08-04.02:35:49.608>
created_at = <Date 2020-06-17.13:11:52.313>
labels = ['type-security', 'easy', '3.8', '3.9', '3.10', '3.7', 'library']
title = '[CVE-2020-14422] Hash collisions in IPv4Interface and IPv6Interface'
updated_at = <Date 2020-08-04.02:35:49.607>
user = 'https://github.com/marwenn02'

bugs.python.org fields:

activity = <Date 2020-08-04.02:35:49.607>
actor = 'larry'
assignee = 'none'
closed = True
closed_date = <Date 2020-08-04.02:35:49.608>
closer = 'larry'
components = ['Library (Lib)']
creation = <Date 2020-06-17.13:11:52.313>
creator = 'nnewram'
dependencies = []
files = []
hgrepos = []
issue_num = 41004
keywords = ['patch', 'easy']
message_count = 18.0
messages = ['371738', '371768', '371770', '371793', '371794', '371882', '372030', '372031', '372515', '372606', '372611', '372612', '372677', '372679', '372695', '372720', '372721', '374787']
nosy_count = 12.0
nosy_names = ['jcea', 'larry', 'eric.smith', 'ned.deily', 'corona10', 'miss-islington', 'tapakund', 'Amir', 'Beuc', 'nnewram', 'svaddi', 'rvteja92']
pr_nums = ['20956', '21033', '21220', '21221', '21231', '21232', '21233']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue41004'
versions = ['Python 3.5', 'Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']

[marwenn02]

In the ipaddress library there exists two classes IPv4Interface, and IPv6Interface. These classes' hash functions will always return 32 and 64 respectively. If IPv4Interface or IPv6Interface objects then are put in a dictionary, on for example a server storing IPs, this will cause hash collisions, which in turn can lead to DOS.

The root of this is on line 1421 and 2095. On both lines, self._ip and self.network.network_address will both be same, and when xor is applied they will cancel eachother out, leaving return self._prefixlen .
Since self._prefixlen is a constant, 32 and 64 respectively, this will lead to a constant hash.

The fix is trivial, on line 1421, change to:
return hash((self._ip, self._prefixlen, int(self.network.network_address)))

and on line 2095, change to:
return hash((self._ip, self._prefixlen, int(self.network.network_address)))

[ericvsmith]

Good catch. Your approach seems like a good one.

[marwenn02]

Forgot to add, this applies to all versions, 3.10, 3.9, 3.8, 3.7, 3.6, 3.5