https://sourceware.org/bugzilla/show_bug.cgi?id=34473
Bug ID: 34473
Summary: `readelf -a: heap-buffer-overflow (OOB read) in
byte_get_little_endian via
process_got_section_contents on malformed ELF GOT
section`
Product: binutils
Version: unspecified
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: binutils
Assignee: unassigned at sourceware dot org
Reporter: 2722900221 at qq dot com
Target Milestone: ---
Created attachment 16898
--> https://sourceware.org/bugzilla/attachment.cgi?id=16898&action=edit
PoC
### Summary
`readelf -a` on a crafted ELF performs an out-of-bounds heap read in
`process_got_section_contents`. The GOT section data buffer is allocated sized
by `sh_size` (`get_section_contents` → `get_data`), but the display loop
iterates `entries = sh_size / sh_entsize` times while reading a fixed-width
field (`struct got64 { unsigned char bytes[4]; }`) via `BYTE_GET`. A malformed
section header whose `sh_entsize` is smaller than the 4-byte element readelf
reads inflates the iteration count so that later iterations read past the end
of the allocated buffer. readelf does emit "out of range sh_entsize" warnings
but proceeds with the dump instead of skipping the section, so the OOB read is
reached.
This is a **read** overrun (no write primitive) in a tool that parses untrusted
ELF files — a crash / potential info-leak.
### Affected version
GNU Binutils **2.47.50.20260803**, commit `5c78aef60`.
### Reproduce
```bash
ASAN_OPTIONS=abort_on_error=1:symbolize=1:detect_leaks=0:allocator_may_return_null=1
\
./install/bin/readelf -a readelf_got_heapoverflow.min
```
### ASAN log
```
==3663912==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x606000000831 at pc 0x5555558329fa bp 0x7fffffffd5b0 sp 0x7fffffffd5a8
READ of size 1 at 0x606000000831 thread T0
#0 0x5555558329f9 in byte_get_little_endian binutils/elfcomm.c:133:22
#1 0x55555579c77d in process_got_section_contents
binutils/readelf.c:21796:7
#2 0x55555579c77d in process_object binutils/readelf.c:25121:9
#3 0x555555792e9a in process_file binutils/readelf.c:25544:13
#4 0x555555792e9a in main binutils/readelf.c:25610:11
#5 0x7ffff7ca7d8f in __libc_start_call_main
#6 0x7ffff7ca7e3f in __libc_start_main
#7 0x5555556d24d4 in _start
0x606000000831 is located 0 bytes to the right of 49-byte region
[0x606000000800,0x606000000831)
allocated by thread T0 here:
#0 0x55555575531e in __interceptor_malloc
#1 0x5555557905b7 in get_data binutils/readelf.c:556:14
#2 0x55555579c47a in get_section_contents binutils/readelf.c:17171:20
#3 0x55555579c47a in process_got_section_contents
binutils/readelf.c:21709:27
#4 0x55555579c47a in process_object binutils/readelf.c:25121:9
#5 0x555555792e9a in process_file binutils/readelf.c:25544:13
#6 0x555555792e9a in main binutils/readelf.c:25610:11
SUMMARY: AddressSanitizer: heap-buffer-overflow binutils/elfcomm.c:133:22 in
byte_get_little_endian
==3663912==ABORTING
```
--
You are receiving this mail because:
You are on the CC list for the bug.
