[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 31 Dec 2014 14:09:23 +0800 (CST)
From: xiaoqixue_1 <xiaoqixue_1@....com>
To: oss-security@...ts.openwall.com
Subject: CVE Request, Use after free vulnerability in Dwarfdump
Hi,
we report a vulnerability in DwarfDump which is shipped
with every release of the SGI MIPS/IRIX C compiler.
we have reported the issue to vendor and linux Bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=1177758
the details as follows:
Advisory: Use after free vulnerability in Dwarfdump.
Advisory ID: -
Author : Qixue Xiao , Tao He
Affected Sofware: dwarf-20130126 -- dwarf-20140805 (tested)
Vendor URL: http://www.prevanders.net/dwarf.html
Vendor Status: reported
CVE-ID : -
================================
Vulnerability Description:
================================
There is a UAF(used after free) in dwarf-20130126 and dwarf-20140805, and we have tested the two version, so we guess the versions which are between them will be affected too.
when an odd elf file passed to dwarfdump, it would use an object which have be freed before.
=========================================
Details:
==========================================
if an elf file is passed to dwarfdump, 'dwarf_elf_init' will be called and the 'Dwarf_Debug' object will be free in 'dwarf_elf_object_access_finish', if the elf file is not in correct format.
--------------------------------
res = dwarf_object_init(binary_interface, errhand, errarg,
ret_dbg, error);
if (res != DW_DLV_OK){
dwarf_elf_object_access_finish(binary_interface);
}
--------------------------------
And the object will be refered again in 'print_error' :
--------------------------
if (obj->object) {
dwarf_elf_object_access_internals_t *internals =
(dwarf_elf_object_access_internals_t *)obj->object;
--------------------------
when debugging it with gdb, the error information as follows:
--------------------------------
/home/xqx/test/dwarf_test/dwarf-20140805/dwarfdump/dwarfdump ERROR: dwarf_elf_init: DW_DLE_ELF_STRPTR_ERROR 30 a
call to elf_strptr() failed trying to get a section name (30)
CU Name =
CU Producer =
DIE OFF = 0x00000000 GOFF = 0x00000000, Low PC = 0x00000000, High PC = 0x00000000
Program received signal SIGSEGV, Segmentation fault.
0x0000000000436305 in dwarf_finish (dbg=0x1, error=0x7fffffffe030) at dwarf_original_elf_init.c:193
193 dwarf_elf_object_access_finish(dbg->de_obj_file);
-----------------------------------------------
====================
Status:
=====================
We have sent email to libdwarf-list@...thlink.net to report it.
==================
references:
==================
http://www.prevanders.net/dwarf.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
