From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <elfutils-devel-return-6545-listarch-elfutils-devel=sourceware.org@sourceware.org>
Received: (qmail 104018 invoked by alias); 16 Mar 2018 14:33:45 -0000
Mailing-List: contact elfutils-devel-help@sourceware.org; run by ezmlm
Precedence: bulk
List-Id: <elfutils-devel.sourceware.org>
List-Post: <mailto:elfutils-devel@sourceware.org>
List-Help: <mailto:elfutils-devel-help@sourceware.org>
List-Subscribe: <mailto:elfutils-devel-subscribe@sourceware.org>
Sender: elfutils-devel-owner@sourceware.org
Received: (qmail 103954 invoked by uid 48); 16 Mar 2018 14:33:41 -0000
From: "probefuzzer at gmail dot com" <sourceware-bugzilla@sourceware.org>
To: elfutils-devel@sourceware.org
Subject: [Bug general/22976] New: global-buffer-overflow in ebl_dynamic_tag_name (libebl/ebldynamictagname.c)
Date: Fri, 16 Mar 2018 14:33:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: elfutils
X-Bugzilla-Component: general
X-Bugzilla-Version: unspecified
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: probefuzzer at gmail dot com
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: unassigned at sourceware dot org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter cc target_milestone attachments.created
Message-ID: <bug-22976-10460@http.sourceware.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://sourceware.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2018-q1/txt/msg00077.txt.bz2

https://sourceware.org/bugzilla/show_bug.cgi?id=3D22976

            Bug ID: 22976
           Summary: global-buffer-overflow in ebl_dynamic_tag_name
                    (libebl/ebldynamictagname.c)
           Product: elfutils
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: general
          Assignee: unassigned at sourceware dot org
          Reporter: probefuzzer at gmail dot com
                CC: elfutils-devel at sourceware dot org
  Target Milestone: ---

Created attachment 10899
  --> https://sourceware.org/bugzilla/attachment.cgi?id=3D10899&action=3Ded=
it
poc

On latest version (elfutils-0.170) and master branch of elfutils:
there is a global-buffer-overflow in ebl_dynamic_tag_name function of
(libebl/ebldynamictagname.c), which can be triggered by the POC below.=20

To reproduce the issue, compile elfutils with asan and run: ./bin/eu-readel=
f -a
$POC

=3D=3D13884=3D=3DERROR: AddressSanitizer: global-buffer-overflow on address
0x0000006c18d0 at pc 0x00000048e6b4 bp 0x7fffffffc5c0 sp 0x7fffffffc5b8
READ of size 8 at 0x0000006c18d0 thread T0
    #0 0x48e6b3 in ebl_dynamic_tag_name
/u/xw48/GreedyFuzzing/product/elfutils/master-test/src/libebl/ebldynamictag=
name.c:59
    #1 0x47602b in handle_dynamic
/u/xw48/GreedyFuzzing/product/elfutils/master-test/src/src/readelf.c:1708
    #2 0x47602b in print_dynamic
/u/xw48/GreedyFuzzing/product/elfutils/master-test/src/src/readelf.c:1813
    #3 0x47602b in process_elf_file
/u/xw48/GreedyFuzzing/product/elfutils/master-test/src/src/readelf.c:911
    #4 0x479fde in process_dwflmod
/u/xw48/GreedyFuzzing/product/elfutils/master-test/src/src/readelf.c:707
    #5 0x7fe8230dc22c in dwfl_getmodules
/u/xw48/GreedyFuzzing/product/elfutils/master-test/src/libdwfl/dwfl_getmodu=
les.c:86
    #6 0x412568 in process_file
/u/xw48/GreedyFuzzing/product/elfutils/master-test/src/src/readelf.c:806
    #7 0x4059f3 in main
/u/xw48/GreedyFuzzing/product/elfutils/master-test/src/src/readelf.c:322
    #8 0x7fe8229b5c04 in __libc_start_main (/lib64/libc.so.6+0x21c04)
    #9 0x406493=20
(/home/xw48/GreedyFuzzing/product/elfutils/master-test/exe_asan/bin/eu-read=
elf+0x406493)

--=20
You are receiving this mail because:
You are on the CC list for the bug.