Issue 56134 in oss-fuzz: elfutils:fuzz-libdwfl: Use-of-uninitialized-value in check_section

Issue 56134 in oss-fuzz: elfutils:fuzz-libdwfl: Use-of-uninitialized-value in check_section

[ClusterFuzz-External via monorail]

[-- Attachment #1: Type: text/plain, Size: 1824 bytes --]

Status: New
Owner: ----
CC: elfut...@sourceware.org, da...@adalogics.com, evv...@gmail.com, izzeem@google.com 
Labels: ClusterFuzz Reproducible Stability-Memory-MemorySanitizer Engine-libfuzzer OS-Linux Security_Severity-Medium Proj-elfutils Reported-2023-02-19
Type: Bug-Security

New issue 56134 by ClusterFuzz-External: elfutils:fuzz-libdwfl: Use-of-uninitialized-value in check_section
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56134

Detailed Report: https://oss-fuzz.com/testcase?key=6724057145147392

Project: elfutils
Fuzzing Engine: libFuzzer
Fuzz Target: fuzz-libdwfl
Job Type: libfuzzer_msan_elfutils
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  check_section
  dwarf_begin_elf
  load_dw
  
Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Regressed: https://oss-fuzz.com/revisions?job=libfuzzer_msan_elfutils&range=202302161800:202302181800

Reproducer Testcase: https://oss-fuzz.com/download?testcase_id=6724057145147392

Issue filed automatically.

See https://google.github.io/oss-fuzz/advanced-topics/reproducing for instructions to reproduce this bug locally.
When you fix this bug, please
  * mention the fix revision(s).
  * state whether the bug was a short-lived regression or an old bug in any stable releases.
  * add any other useful information.
This information can help downstream consumers.

If you need to contact the OSS-Fuzz team with a question, concern, or any other feedback, please file an issue at https://github.com/google/oss-fuzz/issues. Comments on individual Monorail issues are not monitored.

-- 
You received this message because:
  1. You were specifically CC'd on the issue

You may adjust your notification preferences at:
https://bugs.chromium.org/hosting/settings

Reply to this email to add a comment.

Issue 56134 in oss-fuzz: elfutils:fuzz-libdwfl: Use-of-uninitialized-value in check_section

[evv… via monorail]

[-- Attachment #1: Type: text/plain, Size: 3730 bytes --]


Comment #1 on issue 56134 by evv...@gmail.com: elfutils:fuzz-libdwfl: Use-of-uninitialized-value in check_section
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56134#c1

Below is the full backtrace
```
==2272==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x5fb3c7 in check_section /src/elfutils/libdw/dwarf_begin_elf.c:265:7
    #1 0x5f8d3e in global_read /src/elfutils/libdw/dwarf_begin_elf.c:444:14
    #2 0x5f8d3e in dwarf_begin_elf /src/elfutils/libdw/dwarf_begin_elf.c:595:9
    #3 0x53f28c in load_dw /src/elfutils/libdwfl/dwfl_module_getdwarf.c:1341:13
    #4 0x53c5b9 in find_dw /src/elfutils/libdwfl/dwfl_module_getdwarf.c:1391:16
    #5 0x53c5b9 in dwfl_module_getdwarf /src/elfutils/libdwfl/dwfl_module_getdwarf.c:1446:3
    #6 0x534b72 in LLVMFuzzerTestOneInput /src/fuzz-libdwfl.c:54:3
    #7 0x43dcf3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15
    #8 0x429452 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6
    #9 0x42ecfc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9
    #10 0x458232 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #11 0x7fe0978dd0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/libc-start.c:308:16
    #12 0x41f61d in _start
  Uninitialized value was created by a heap allocation
    #0 0x4e2310 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/msan/msan_interceptors.cpp:895:3
    #1 0x6b9935 in convert_data /src/elfutils/libelf/elf_getdata.c:166:24
    #2 0x6b9935 in __libelf_set_data_list_rdlock /src/elfutils/libelf/elf_getdata.c:455:7
    #3 0x6ba571 in __elf_getdata_rdlock /src/elfutils/libelf/elf_getdata.c:562:5
    #4 0x6ba6cd in elf_getdata /src/elfutils/libelf/elf_getdata.c:580:12
    #5 0x5faec7 in check_section /src/elfutils/libdw/dwarf_begin_elf.c:246:20
    #6 0x5f8d3e in global_read /src/elfutils/libdw/dwarf_begin_elf.c:444:14
    #7 0x5f8d3e in dwarf_begin_elf /src/elfutils/libdw/dwarf_begin_elf.c:595:9
    #8 0x53f28c in load_dw /src/elfutils/libdwfl/dwfl_module_getdwarf.c:1341:13
    #9 0x53c5b9 in find_dw /src/elfutils/libdwfl/dwfl_module_getdwarf.c:1391:16
    #10 0x53c5b9 in dwfl_module_getdwarf /src/elfutils/libdwfl/dwfl_module_getdwarf.c:1446:3
    #11 0x534b72 in LLVMFuzzerTestOneInput /src/fuzz-libdwfl.c:54:3
    #12 0x43dcf3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15
    #13 0x429452 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6
    #14 0x42ecfc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9
    #15 0x458232 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #16 0x7fe0978dd0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/libc-start.c:308:16
SUMMARY: MemorySanitizer: use-of-uninitialized-value (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_elfutils_3ee01cb67db1a71e7adeb7f3f14722ea62f13cd5/revisions/fuzz-libdwfl+0x5fb3c7)
```

Looks like it was introduced in https://sourceware.org/git/?p=elfutils.git;a=commitdiff;h=fda09f5f188fb173b2123815be71ca4647a8adfb

-- 
You received this message because:
  1. You were specifically CC'd on the issue

You may adjust your notification preferences at:
https://bugs.chromium.org/hosting/settings

Reply to this email to add a comment.

Issue 56134 in oss-fuzz: elfutils:fuzz-libdwfl: Use-of-uninitialized-value in check_section

[evv… via monorail]

[-- Attachment #1: Type: text/plain, Size: 2902 bytes --]


Comment #2 on issue 56134 by evv...@gmail.com: elfutils:fuzz-libdwfl: Use-of-uninitialized-value in check_section
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56134#c2

It can be confirmed with Valgrind:
```
wget -O OSS-FUZZ-56134 'https://oss-fuzz.com/download?testcase_id=6724057145147392'

LD_LIBRARY_PATH="$(pwd)/libdw:$(pwd)/libelf" DEBUGINFOD_URLS= valgrind --track-origins=yes ./src/readelf -w OSS-FUZZ-56134
==1373524== Memcheck, a memory error detector
==1373524== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==1373524== Using Valgrind-3.19.0 and LibVEX; rerun with -h for copyright info
==1373524== Command: ./src/readelf -w OSS-FUZZ-56134
==1373524==
==1373524== Conditional jump or move depends on uninitialised value(s)
==1373524==    at 0x4887EAB: check_section (dwarf_begin_elf.c:265)
==1373524==    by 0x48885EF: global_read (dwarf_begin_elf.c:444)
==1373524==    by 0x48885EF: dwarf_begin_elf (dwarf_begin_elf.c:595)
==1373524==    by 0x48A9F0C: load_dw (dwfl_module_getdwarf.c:1341)
==1373524==    by 0x48AA0D0: find_dw (dwfl_module_getdwarf.c:1391)
==1373524==    by 0x48AA0D0: dwfl_module_getdwarf (dwfl_module_getdwarf.c:1446)
==1373524==    by 0x411109: print_debug (readelf.c:11467)
==1373524==    by 0x413A31: process_elf_file (readelf.c:1062)
==1373524==    by 0x4148BC: process_dwflmod (readelf.c:818)
==1373524==    by 0x48A7F20: dwfl_getmodules (dwfl_getmodules.c:86)
==1373524==    by 0x40954A: process_file (readelf.c:926)
==1373524==    by 0x404D0E: main (readelf.c:395)
==1373524==  Uninitialised value was created by a heap allocation
==1373524==    at 0x484586F: malloc (vg_replace_malloc.c:381)
==1373524==    by 0x48FEA25: convert_data (elf_getdata.c:166)
==1373524==    by 0x48FEA25: __libelf_set_data_list_rdlock (elf_getdata.c:455)
==1373524==    by 0x48FEC17: __elf_getdata_rdlock (elf_getdata.c:562)
==1373524==    by 0x4887E6F: check_section (dwarf_begin_elf.c:246)
==1373524==    by 0x48885EF: global_read (dwarf_begin_elf.c:444)
==1373524==    by 0x48885EF: dwarf_begin_elf (dwarf_begin_elf.c:595)
==1373524==    by 0x48A9F0C: load_dw (dwfl_module_getdwarf.c:1341)
==1373524==    by 0x48AA0D0: find_dw (dwfl_module_getdwarf.c:1391)
==1373524==    by 0x48AA0D0: dwfl_module_getdwarf (dwfl_module_getdwarf.c:1446)
==1373524==    by 0x411109: print_debug (readelf.c:11467)
==1373524==    by 0x413A31: process_elf_file (readelf.c:1062)
==1373524==    by 0x4148BC: process_dwflmod (readelf.c:818)
==1373524==    by 0x48A7F20: dwfl_getmodules (dwfl_getmodules.c:86)
==1373524==    by 0x40954A: process_file (readelf.c:926)
==1373524==
./src/readelf: cannot get debug context descriptor: No DWARF information found
```

-- 
You received this message because:
  1. You were specifically CC'd on the issue

You may adjust your notification preferences at:
https://bugs.chromium.org/hosting/settings

Reply to this email to add a comment.

Issue 56134 in oss-fuzz: elfutils:fuzz-libdwfl: Use-of-uninitialized-value in check_section

[ClusterFuzz-External via monorail]

[-- Attachment #1: Type: text/plain, Size: 537 bytes --]

Updates:
	Labels: -Reproducible Unreproducible

Comment #3 on issue 56134 by ClusterFuzz-External: elfutils:fuzz-libdwfl: Use-of-uninitialized-value in check_section
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56134#c3

ClusterFuzz testcase 6724057145147392 appears to be flaky, updating reproducibility label.

-- 
You received this message because:
  1. You were specifically CC'd on the issue

You may adjust your notification preferences at:
https://bugs.chromium.org/hosting/settings

Reply to this email to add a comment.

Issue 56134 in oss-fuzz: elfutils:fuzz-libdwfl: Use-of-uninitialized-value in check_section

[ClusterFuzz-External via monorail]

[-- Attachment #1: Type: text/plain, Size: 477 bytes --]


Comment #5 on issue 56134 by ClusterFuzz-External: elfutils:fuzz-libdwfl: Use-of-uninitialized-value in check_section
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56134#c5

ClusterFuzz testcase 6724057145147392 is closed as invalid, so closing issue.

-- 
You received this message because:
  1. You were specifically CC'd on the issue

You may adjust your notification preferences at:
https://bugs.chromium.org/hosting/settings

Reply to this email to add a comment.

Issue 56134 in oss-fuzz: elfutils:fuzz-libdwfl: Use-of-uninitialized-value in check_section

[ClusterFuzz-External via monorail]

[-- Attachment #1: Type: text/plain, Size: 603 bytes --]

Updates:
	Status: WontFix

Comment #4 on issue 56134 by ClusterFuzz-External: elfutils:fuzz-libdwfl: Use-of-uninitialized-value in check_section
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56134#c4

ClusterFuzz testcase 6724057145147392 is flaky and no longer crashes, so closing issue.

If this is incorrect, please file a bug on https://github.com/google/oss-fuzz/issues/new

-- 
You received this message because:
  1. You were specifically CC'd on the issue

You may adjust your notification preferences at:
https://bugs.chromium.org/hosting/settings

Reply to this email to add a comment.