https://sourceware.org/bugzilla/show_bug.cgi?id=33005
Bug ID: 33005
Summary: Dynamic Stack Buffer Overflow in eu-unstrip's
new_shstrtab Function
Product: elfutils
Version: unspecified
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: tools
Assignee: unassigned at sourceware dot org
Reporter: xdcao.cs at gmail dot com
CC: elfutils-devel at sourceware dot org
Target Milestone: ---
Summary
Dynamic Stack Buffer Overflow in eu-unstrip's new_shstrtab Function
Environment
elfutils version: 0.192
OS: Ubuntu 22.04.5 LTS
Steps to reproduce
# export CFLAGS="-g -O0 -fno-inline -fno-lto -fsanitize=address"
# export CXXFLAGS="-g -O0 -fno-inline -fno-lto -fsanitize=address"
# ./configure --enable-maintainer-mode --disable-debuginfod
# make -j64 & make install
root@c6c01f72391e:# ./eu-unstrip -F POC/POC1 POC/POC2
=================================================================
==549005==ERROR: AddressSanitizer: dynamic-stack-buffer-overflow on address
0x7ffd6ef87470 at pc 0x0000004dd808 bp 0x7ffd6ef87390 sp 0x7ffd6ef87388
WRITE of size 8 at 0x7ffd6ef87470 thread T0
#0 0x4dd807 in new_shstrtab
/workspace/new-test/program/elfutils/src/unstrip.c:1380:50
#1 0x4d2183 in copy_elided_sections
/workspace/new-test/program/elfutils/src/unstrip.c:1682:27
#2 0x4cfc2a in handle_file
/workspace/new-test/program/elfutils/src/unstrip.c:2234:5
#3 0x4ce648 in handle_explicit_files
/workspace/new-test/program/elfutils/src/unstrip.c:2331:3
#4 0x4ccf0e in main
/workspace/new-test/program/elfutils/src/unstrip.c:2661:2
#5 0x7f11d46bdd8f in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#6 0x7f11d46bde3f in __libc_start_main csu/../csu/libc-start.c:392:3
#7 0x420764 in _start
(/workspace/new-test/fuzzdir/fz-elfutils/fz-eu-unstrip/eu-unstrip+0x420764)
Address 0x7ffd6ef87470 is located in stack of thread T0
SUMMARY: AddressSanitizer: dynamic-stack-buffer-overflow
/workspace/new-test/program/elfutils/src/unstrip.c:1380:50 in new_shstrtab
Shadow bytes around the buggy address:
0x10002dde8e30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10002dde8e40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10002dde8e50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10002dde8e60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10002dde8e70: 00 00 00 00 ca ca ca ca 00 00 00 00 00 00 00 00
=>0x10002dde8e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[cb]cb
0x10002dde8e90: cb cb cb cb f1 f1 f1 f1 f8 f8 f8 f8 f8 f8 f8 f8
0x10002dde8ea0: f2 f2 f2 f2 f8 f8 f8 f8 f8 f8 f8 f8 f3 f3 f3 f3
0x10002dde8eb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10002dde8ec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10002dde8ed0: ca ca ca ca 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==549005==ABORTING
POC
https://drive.google.com/file/d/1PIomLS8od5Rd0w_ru5HGr84d501OM5oa/view?usp=sharing
Credit
Xiaoguo Li (CUPL)
Xudong Cao (UCAS)
--
You are receiving this mail because:
You are on the CC list for the bug.
