Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 30 Jun 2012 14:23:47 +0530
From: Dhiru Kholia <dhiru.kholia@...il.com>
To: john-dev@...ts.openwall.com
Subject: asan report

Hi,

So far, I have found out that asan doesn't work with the following formats:

Target : linux-x86-64-clang-debug

$ clang --version
clang version 3.1 (branches/release_31)
Target: x86_64-unknown-linux-gnu
Thread model: posix


1. xsha

Benchmarking: Mac OS X 10.4 - 10.6 salted SHA-1 [128/128 SSE2
intrinsics 8x]...
=================================================================
==28010== ERROR: AddressSanitizer global-buffer-overflow on address
0x0000006b0240 at pc 0x4da4f4 bp 0x7fff9f71ff10 sp 0x7fff9f71ff08
READ of size 4 at 0x0000006b0240 thread T0
    #0 0x4da4f4 in set_key /home/dsk/magnum-jumbo/src/XSHA_fmt_plug.c:304
0x0000006b0240 is located 0 bytes inside of global variable '.str12
(formats.c)' (0x6b0240) of size 1
  '.str12 (formats.c)' is ascii string ''

  while((temp = *wkey++) & 0xff) { <== problematic code
                if (!(temp & 0xff00))
                {
                        *keybuf_word = JOHNSWAP((temp & 0xff) | (0x80 << 8));
                        len++;
                        goto key_cleaning;
                }


2.  trip

Benchmarking: Tripcode DES [128/128 BS SSE2-16]...
=================================================================
==28647== ERROR: AddressSanitizer global-buffer-overflow on address
0x0000006b0240 at pc 0x4414c9 bp 0x7fff45bf30c0 sp 0x7fff45bf30b8
READ of size 8 at 0x0000006b0240 thread T0
    #0 0x4414c9 in set_key /home/dsk/magnum-jumbo/src/trip_fmt.c:547
0x0000006b0240 is located 0 bytes inside of global variable '.str12
(formats.c)' (0x6b0240) of size 1
  '.str12 (formats.c)' is ascii string ''

static void set_key(char *key, int index)
{
        memcpy(buffer[index].key, key, PLAINTEXT_LENGTH);
}

This code doesn't seem to check key's length.


3. BSDI (reported in another thread)

4.  dynamic format (reported in another thread)

5. sapb

Benchmarking: SAP CODVN B (BCODE) [128/128 SSE2 intrinsics 20x]...
=================================================================
==29216== ERROR: AddressSanitizer global-buffer-overflow on address
0x0000006779e0 at pc 0x4d514f bp 0x7fff67fff8a0 sp 0x7fff67fff898
READ of size 8 at 0x0000006779e0 thread T0
    #0 0x4d514f in set_key /home/dsk/magnum-jumbo/src/sapB_fmt_plug.c:191
0x0000006779e0 is located 0 bytes inside of global variable '.str6
(sapB_fmt_plug.c)' (0x6779e0) of size 2
  '.str6 (sapB_fmt_plug.c)' is ascii string 'X'

static void set_key(char *key, int index)
{
        memcpy(saved_plain[index], key, PLAINTEXT_LENGTH);
        keyLen[index] = -1;
}

6. sapg

Benchmarking: SAP CODVN F/G (PASSCODE) [128/128 SSE2 intrinsics 8x]...
=================================================================
==29453== ERROR: AddressSanitizer global-buffer-overflow on address
0x0000006b0292 at pc 0x4ef363 bp 0x7fff69397f50 sp 0x7fff69397f48
READ of size 1 at 0x0000006b0292 thread T0
    #0 0x4ef363 in set_key /home/dsk/magnum-jumbo/src/sapG_fmt_plug.c:205
0x0000006b0292 is located 14 bytes to the right of global variable
'.str13 (formats.c)' (0x6b0280) of size 4
  '.str13 (formats.c)' is ascii string 'des'

static void set_key(char *key, int index)
{
        memcpy((char*)saved_plain[index], key, PLAINTEXT_LENGTH);
        keyLen[index] = -1;
}

7. salted-sha1

Benchmarking: Salted SHA-1 [128/128 SSE2 intrinsics 8x]...
=================================================================
==29737== ERROR: AddressSanitizer global-buffer-overflow on address
0x000000683844 at pc 0x4f2c5e bp 0x7ffff61eb420 sp 0x7ffff61eb418
READ of size 4 at 0x000000683844 thread T0
    #0 0x4f2c5e in set_key /home/dsk/magnum-jumbo/src/salted_sha1_fmt_plug.c:163
0x000000683844 is located 4 bytes inside of global variable '.str6
(salted_sha1_fmt_plug.c)' (0x683840) of size 7
  '.str6 (salted_sha1_fmt_plug.c)' is ascii string 'thales'

while((temp = *wkey++) & 0xff) { <== have seen such a loop mutiple times now :-)
                if (!(temp & 0xff00))
                {
                        *keybuf_word = JOHNSWAP((temp & 0xff) | (0x80 << 8));
                        len++;
                        goto key_cleaning;
                }


8. raw-sha1-ng

Benchmarking: Raw SHA-1 (pwlen <= 15) [128/128 SSE2 intrinsics 4x]...
=================================================================
==30079== ERROR: AddressSanitizer global-buffer-overflow on address
0x0000006a9020 at pc 0x537f2e bp 0x7fff53cb89e0 sp 0x7fff53cb89d8
READ of size 16 at 0x0000006a9020 thread T0
    #0 0x537f2e in sha1_fmt_set_key
/home/dsk/magnum-jumbo/src/rawSHA1_ng_fmt.c:363

9. raw-sha1-linkedin


Benchmarking: Raw SHA-1 LinkedIn [128/128 SSE2 intrinsics 8x]...
=================================================================
==30895== ERROR: AddressSanitizer global-buffer-overflow on address
0x000000696d8c at pc 0x5100f4 bp 0x7fff9d8f92e0 sp 0x7fff9d8f92d8
READ of size 4 at 0x000000696d8c thread T0
    #0 0x5100f4 in rawsha1_set_key
/home/dsk/magnum-jumbo/src/rawSHA1_linkedIn_fmt_plug.c:141

        while((unsigned char)(temp = *wkey++)) {
                if (!(temp & 0xff00))
                {
                        *keybuf_word = JOHNSWAP((temp & 0xff) | (0x80 << 8));
                        len++;
                        goto key_cleaning;
                }

10. Other formats which don't work with asan are raw-sha1, raw-md5,
raw-md4, oracle11, nsldap, netntlm, netlm, nethalflm, mysql-sha1,
hmac-md5, hmac-sha1, and ipb2

Lets start fixing these formats.

-- 
Cheers,
Dhiru

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ