https://sourceware.org/bugzilla/show_bug.cgi?id=27295
Bug ID: 27295
Summary: Unsafe strcmp() causing arbitrary read primitive and
potential privacy impact in elf32_avr_get_note_desc()
Product: binutils
Version: 2.36
Status: UNCONFIRMED
Severity: critical
Priority: P2
Component: binutils
Assignee: unassigned at sourceware dot org
Reporter: dennis.r at columbia dot edu
Target Milestone: ---
Created attachment 13181
--> https://sourceware.org/bugzilla/attachment.cgi?id=13181&action=edit
poc
= Attachment =
./memory
= Reproduce =
Compile with ./configure -enable=avr
objdump --private=mem-usage memory
= Location =
https://sourcegraph.com/github.com/bminor/binutils-gdb@a7e3d08a26edefa411269636d7dcae7dd2736659/-/blob/binutils/od-elf32_avr.c#L117
= Description =
Using unsafe version of strcmp on user defined input in.namedata. Arbitrary
read primitive can be used in rop chain and aide exploitation.
if (strcmp (in.namedata, "AVR") != 0)
= Fix =
Use strncmp
= UBSan =
../seed_folder/memory: file format elf32-avr
../../binutils/od-elf32_avr.c:107:42: runtime error: unsigned integer overflow:
18446744073709551604 + 60 cannot be represented in type 'unsigned long'
../../binutils/od-elf32_avr.c:111:31: runtime error: negation of 4 cannot be
represented in type 'bfd_vma' (aka 'unsigned long')
../../binutils/od-elf32_avr.c:114:51: runtime error: unsigned integer overflow:
18446744073709551600 + 60 cannot be represented in type 'unsigned long'
= Stack Trace =
Breakpoint 1, elf32_avr_dump (abfd=<optimized out>) at
../../binutils/od-elf32_avr.c:107
107 if (in.namesz > contents - in.namedata + size)
(gdb) bt
#0 elf32_avr_dump (abfd=<optimized out>) at ../../binutils/od-elf32_avr.c:107
#1 0x000000000041e80d in dump_target_specific (abfd=0x38f4c90) at
../../binutils/objdump.c:4282
#2 dump_bfd (abfd=0x38f4c90, is_mainfile=1) at ../../binutils/objdump.c:4870
#3 0x000000000041bc6f in display_object_bfd (abfd=<optimized out>) at
../../binutils/objdump.c:5008
#4 display_any_bfd (file=<optimized out>, level=<optimized out>) at
../../binutils/objdump.c:5098
#5 0x000000000040757d in display_file (filename=<optimized out>,
target=<optimized out>, last_file=<optimized out>) at
../../binutils/objdump.c:5119
#6 main (argc=<optimized out>, argv=<optimized out>) at
../../binutils/objdump.c:5467
--
You are receiving this mail because:
You are on the CC list for the bug.
