I reviewed pigz 2.8-2ubuntu1 as checked into stonking. This shouldn't be
considered a full audit but rather a quick gauge of maintainability.
pigz is a Parallel Implementation of GZip: a drop-in replacement for gzip that
splits compression into chunks processed by multiple pthread worker threads and
assembles the stream, giving near-linear speedup on multi-core hosts.
Decompression (-d) is single-threaded and is exposed as the companion binary
unpigz. The codebase is essentially one C source (pigz.c, ~4700 lines) plus the
zopfli deflate library (zopfli/) and a small threading library (yarn.c). Both
shipped binaries are /usr/bin/pigz and /usr/bin/unpigz (a symlink to pigz).
There are no daemons, services, network, or cryptographic code paths.
- CVE History
- The only pigz CVE is CVE-2013-0296 (race: pre-2.2.5 created output with
umask-derived permissions before copying the source file's mode, letting a
local user read the in-progress output). Fixed upstream in 2.2.4-2; every
Ubuntu release is recorded not-affected (2.3-2 / 2.3.1-2). Current code
creates output with a restrictive 0600 mode (pigz.c:4131, :4165) and only
copies the source mode afterwards, so the exposure window no longer exists.
- CVE-2026-41567 is a Moby/Docker vulnerability, not a pigz one.
pigz/unpigz is named only because Docker's container archive API shells out
to a decompression binary on the container path.
- Build-Depends
- debhelper (>= 10), zlib1g-dev, libzopfli-dev. Runtime deps -libc.so.6,
libz.so.1, libzopfli.so.1. No sensitive/exotic libraries
(no networking, crypto, or scripting libs).
- pre/post inst/rm scripts
- Only a prerm is shipped (debian/pigz.prerm). It guards removal: if /bin/gzip
currently resolves to /usr/bin/pigz (update-alternatives) removal is
blocked so gzip is not left unusable.
- init scripts
- None.
- systemd units
- None.
- dbus services
- None.
- setuid binaries
- None.
- binaries in PATH
- /usr/bin/pigz is a normal utility in $PATH. Expected for a compression
tool; it is not a privileged or wrapper binary.
- sudo fragments
- None.
- polkit files
- None.
- udev rules
- None.
- unit tests / autopkgtests
- Present. make test does gzip-comparison round-trip tests, and
debian/tests/{simple-pigz,advanced-usage-pigz} ship autopkgtests that
exercise the compress/decompress paths.
- cron jobs
- None.
- Build logs
- gcc compile is clean (no errors, no warnings).
- Processes spawned
- None. No system()/popen() in either pigz.c or the bundled zopfli. No
shell-injection surface.
- Memory management
- Careful overall. Allocation is funneled through a custom yarn allocator
wrapping malloc/realloc; strings use bounds-aware vmemcpy/vstrcpy helpers.
strcpy appears at pigz.c:821 (me->msg, an error record) and
pigz.c:3115-3132 (tag/mod, derived from the file's mtime); these are
bounded, source-controlled contexts.
memcpy/memmove occurrences are size-bounded by the surrounding length
bookkeeping. No overflow pattern evident.
- File IO
- Inputs opened O_RDONLY (pigz.c:4036). Outputs opened with mode 0600 and
O_EXCL unless --force (which switches to O_TRUNC), at pigz.c:4131 and
:4165. Open/write errors are surfaced via throw(). Output permissions start
at 0600 and are later mirrored to the source file via copymeta(). As with
gzip, the user-specified output path is followed if it is a symlink, this is
documented gzip behaviour.
- Logging
- message() (pigz.c:595) calls vfprintf(stderr, fmt, ap). Every fmt is a
compiler string literal; user-controlled file names are passed only as %s
arguments, never as the format string.
- Environment variable usage
- GZIP and PIGZ env vars are read at startup (pigz.c:4648, :4667) and parsed
as default option strings for legacy gzip compatibility. Intended,
documented behaviour (identical to upstream gzip) affecting only the
invoking user's own process options.
- Use of privileged functions
- copymeta() (pigz.c:3858) calls chmod() and chown() on the freshly written
output to mirror the source file's mode/owner, plus utimes() for the
timestamps. chown is #define'd to a no-op on non-Linux (pigz.c:412); on
Linux it can only reattribute files the caller already owns. copymeta also
copies suid/sgid/sticky bits (gzip lineage); the output is a new file owned
by the current user and the .gz blob is not directly executable, so there is
no privilege-escalation path.
- Use of cryptography / random number sources etc
- None. pigz is compression only - no hashing, certificates or RNG.
- Use of temp files
- None created. No /tmp usage.
- Use of networking
- None. No socket/getaddrinfo/connect calls anywhere (the only http://
occurrences are Apache license headers in zopfli).
- Use of WebKit
- None.
- Use of PolicyKit
- None.
- Any significant cppcheck results
- 1 warning, a false positive: cppcheck flagged the literal #error "Need
zlib version 1.2.3 or later" directive line, not a build error.
- Any significant Coverity results
- 0 defects.
- Any significant shellcheck results
- 0 warnings.
- Any significant bandit results
- 0 warnings.
- Any significant govulncheck results
- 0 vulnerabilities.
- Any significant Semgrep results
- 0 vulnerabilities.
- Very small, well-contained attack surface: one C program, no network, no
spawning, no services, no privileged code, no temp files, clean static
analysis, and modern hardening flags (PIE, stack protector, FORTIFY, RELRO,
BIND_NOW, CFI) on both binaries.
- The only historically significant pigz issue (CVE-2013-0296) is fixed and all
Ubuntu releases are not-affected; the one active 2026 CVE that mentions pigz
belongs to Docker/Moby and does not affect this package.
Security team ACK for promoting pigz to main - given that we MIR for zopfli. No
unpatched vulnerabilities
identified and the static-analysis output is clean.
** CVE added: https://cve.org/CVERecord?id=CVE-2013-0296
** CVE added: https://cve.org/CVERecord?id=CVE-2026-41567
** Changed in: pigz (Ubuntu)
Assignee: Ubuntu Security Team (ubuntu-security) => (unassigned)
** Changed in: pigz (Ubuntu)
Status: New => In Progress
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2150649
Title:
[MIR] Promote pigz
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/pigz/+bug/2150649/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
