https://sourceware.org/bugzilla/show_bug.cgi?id=34496
Bug ID: 34496
Summary: eu-stacktrace: negative Sysprof capture pid causes
heap out-of-bounds read/write in dwfltab_find
Product: elfutils
Version: unspecified
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: tools
Assignee: unassigned at sourceware dot org
Reporter: karankurani3k at gmail dot com
CC: elfutils-devel at sourceware dot org
Target Milestone: ---
Created attachment 16914
--> https://sourceware.org/bugzilla/attachment.cgi?id=16914&action=edit
Detailed analysis and reproduction of a negative Sysprof capture PID causing
heap out-of-bounds read/write in `dwfltab_find()`, including sanitizer results
and impact.
Reporter:
Karan Kurani <[email protected]>
eu-stacktrace uses the signed 32-bit SysprofCaptureFrame.pid value directly in
the dwfltab_find() hash/index calculation.
For a negative pid, the signed calculation can produce a negative table index.
For example, pid = -2 results in idx = -1, causing htab->table[idx] to access
memory before the calloc-allocated hash table.
The issue is reachable through the normal:
eu-stacktrace -i <capture>
input path by modifying only the pid field of a processed Sysprof capture
frame.
Testing against origin/main
fb5473ac7368bbbbc2ea9d86241bd6c882e3fcb5 confirmed:
- ASan heap-buffer-overflow read in dwfltab_find()
- subsequent out-of-bounds writes through the same table entry
- deterministic reproduction 3/3
- same behavior with NDEBUG
- a plain optimized -O2 build can silently corrupt memory without immediately
crashing
I have not demonstrated code execution and am not making an RCE claim.
A detailed root-cause analysis, validation results, and reproduction
description are included in the attached report.
--
You are receiving this mail because:
You are on the CC list for the bug.
