Date: Wed, 01 Feb 2017 10:18:51 +0100 From: Agostino Sarubbo <ago@...too.org> To: oss-security@...ts.openwall.com Subject: pax-utils: scanelf: out of bounds read in scanelf_file_get_symtabs (scanelf.c) Description: pax-utils is a set of tools that check files for security relevant properties. A fuzz on scanelf exposed an out-of bound read. It was reported to vapier which fixed the issue immediately. Unfortunately I can’t get a symbolized ASan stacktrace, so I will show only the useful part of both asan and gdb. # scanelf -s '*' -axetrnibSDIYZB $FILE ==32758==ERROR: AddressSanitizer: unknown-crash on address 0x7f8f9fa252dc at pc 0x00000053c6a0 bp 0x7ffe93a19910 sp 0x7ffe93a19908 READ of size 4 at 0x7f8f9fa252dc thread T0 #0 0x53c69f (/usr/bin/scanelf+0x53c69f) #1 0x51d649 (/usr/bin/scanelf+0x51d649) #2 0x51b97e (/usr/bin/scanelf+0x51b97e) #3 0x51ad43 (/usr/bin/scanelf+0x51ad43) #4 0x51922e (/usr/bin/scanelf+0x51922e) #5 0x7f8f9e7fd61f (/lib64/libc.so.6+0x2061f) #6 0x41a008 (/usr/bin/scanelf+0x41a008) (gdb) bt #8 0x000000000053c6a0 in scanelf_file_get_symtabs (elf=, sym=0x7fffffffcc00, str=0x7fffffffcc20) at scanelf.c:357 #9 0x000000000051d64a in scanelf_file_sym (elf=0x60700000de60, found_sym=) at scanelf.c:1327 #10 scanelf_elfobj (elf=) at scanelf.c:1547 #11 0x000000000051b97f in scanelf_elf (filename=0x7fffffffe50e "1.crashes", fd=, len=) at scanelf.c:1612 #12 scanelf_fileat (dir_fd=, filename=, st_cache=) at scanelf.c:1679 #13 0x000000000051ad44 in scanelf_dirat (dir_fd=, path=) at scanelf.c:1713 #14 0x000000000051922f in scanelf_dir (path=) at scanelf.c:1763 #15 parseargs (argc=5, argv=0x7fffffffe258) at scanelf.c:2273 #16 main (argc=5, argv=) at scanelf.c:2361 Affected version: 1.2 Fixed version: 1.2.1 Commit fix: https://github.com/gentoo/pax-utils/commit/95e5489534ac9e9324c5096286899b688e19ae00 Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00131-pax-utils-scanelf-oobread-scanelf_file_get_symtabs Timeline: 2017-01-23: bug discovered and reported to upstream 2017-01-24: upstream realeased a patch and 1.2.1 2017-02-01: blog post about the issue Note: This bug was found with American Fuzzy Lop. I’d suggest to go to 1.2.2 because of a functionality bug(s) in 1.2.1 Permalink: https://blogs.gentoo.org/ago/2017/02/01/pax-utils-scanelf-out-of-bounds-read-in-scanelf_file_get_symtabs-scanelf-c -- Agostino Sarubbo Gentoo Linux Developer
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.