Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 31 Dec 2014 14:09:23 +0800 (CST)
From: xiaoqixue_1 <>
Subject: CVE Request, Use after free vulnerability in Dwarfdump


we report a vulnerability in DwarfDump which is shipped
with every release of the SGI MIPS/IRIX C compiler.
we have reported the issue to vendor and linux Bugzilla:

the details as follows:  

Advisory: Use after free vulnerability in Dwarfdump. 
Advisory ID: -
Author : Qixue Xiao , Tao He
Affected Sofware:  dwarf-20130126 -- dwarf-20140805 (tested)
Vendor URL:
Vendor Status:  reported
CVE-ID : -

Vulnerability Description:

There is a UAF(used after free) in  dwarf-20130126 and dwarf-20140805, and we have tested the two version, so we guess the versions which are between them will be affected too. 
when an odd elf file passed to dwarfdump, it would use an object which have be freed before.


if an elf file is passed to dwarfdump, 'dwarf_elf_init' will be called and the 'Dwarf_Debug' object will be free in 'dwarf_elf_object_access_finish',  if the elf file is not in correct format.

res = dwarf_object_init(binary_interface, errhand, errarg,
        ret_dbg, error);
    if (res != DW_DLV_OK){

And the object will be refered again in 'print_error' :

    if (obj->object) {
        dwarf_elf_object_access_internals_t *internals =
            (dwarf_elf_object_access_internals_t *)obj->object;

when debugging it with gdb, the error information as follows:

/home/xqx/test/dwarf_test/dwarf-20140805/dwarfdump/dwarfdump ERROR:  dwarf_elf_init:  DW_DLE_ELF_STRPTR_ERROR 30 a 
call to elf_strptr() failed trying to get a section name (30)

CU Name = 
CU Producer = 
DIE OFF = 0x00000000 GOFF = 0x00000000, Low PC = 0x00000000, High PC = 0x00000000

Program received signal SIGSEGV, Segmentation fault.
0x0000000000436305 in dwarf_finish (dbg=0x1, error=0x7fffffffe030) at dwarf_original_elf_init.c:193
193         dwarf_elf_object_access_finish(dbg->de_obj_file);


We have sent email to to report it.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.