GHSA-fpmr-m242-xm7x Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit

• PyPI qiskit: >= 0.45.0, < 1.3.0 → fixed in 1.3.0 • PyPI qiskit-terra: >= 0.45.0, <= 0.46.3 (no fix yet)

Impact A maliciously crafted QPY file containing a malformed `symengine` serialization stream as part of the larger QPY serialization of a `ParameterExpression` object can cause a segfault within the `symengine` library, allowing an attacker to terminate the hosting process deserializing the QPY payload. Patches This issue is addressed in 1.3.0 when using QPY format version 13. QPY format versions 10, 11, and 12 are all still inherently vulnerable if they are using symengine symbolic encoding and `symengine bool: """Function to check if a QPY payload is potentially vulnerable to a symengine vulnerability. Args: path: The path to the QPY file Returns: Whether the specified payload is potentially vulnerable. If ``True`` the conditions for being vulnerable exist, however the payload may not be vulnerable it can't be detected until trying to deserialize. """ with open(path, "rb") as file_obj: version = struct.unpack("!6sB", file_obj.read(7))[1] if version = 13: return False file_obj.seek(0) header_tuple = namedtuple( "FILE_HEADER", [ "preface", "qpy_version", "major_version", "minor_version", "patch_version", "num_programs", "symbolic_encoding", ], ) header_pack_str = "!6sBBBBQc" header_read_size = struct.calcsize(header_pack_str) data = struct.unpack(header_pack_str, file_obj.read(header_read_size)) header = header_tuple(*data) return header.symbolic_encoding == b"e" ``` Note, this function does not tell you whether the payload is malicious and will cause the segfault, just that conditions for it to be potentially malicious exist. It's not possible to know ahead of time whether `symengine` will segfault until the data is passed to that library. References [1] https://github.com/symengine/symengine/commit/eb3e292bf13b2dfdf0fa1c132944af8df2bc7d51