* [Bug tools/27501] New: eu-readelf hang while process crafted file @ 2021-03-03 3:31 polaalemu at gmail dot com 2021-03-03 20:49 ` [Bug tools/27501] " mark at klomp dot org 2023-08-16 14:51 ` mark at klomp dot org 0 siblings, 2 replies; 3+ messages in thread From: polaalemu at gmail dot com @ 2021-03-03 3:31 UTC (permalink / raw) To: elfutils-devel https://sourceware.org/bugzilla/show_bug.cgi?id=27501 Bug ID: 27501 Summary: eu-readelf hang while process crafted file Product: elfutils Version: unspecified Status: UNCONFIRMED Severity: normal Priority: P2 Component: tools Assignee: unassigned at sourceware dot org Reporter: polaalemu at gmail dot com CC: elfutils-devel at sourceware dot org Target Milestone: --- Created attachment 13276 --> https://sourceware.org/bugzilla/attachment.cgi?id=13276&action=edit hang test case Hi, A hang was found in readelf v0.183 (the latest commit 35e49c) in function handle_symtab in readelf.c it seems verneed will always loop ,I didn't analysis deeply. bt [#0] 0x55555556a2d3 → handle_symtab(shdr=0x7fffffffd600, scn=0x5555555dfa58, ebl=<optimized out>) [#1] 0x55555556a2d3 → print_symtab(ebl=<optimized out>, type=0xb) [#2] 0x555555575b95 → process_elf_file(dwflmod=0x5555555de300, fd=<optimized out>) [#3] 0x555555578761 → process_dwflmod(dwflmod=0x5555555de300, userdata=<optimized out>, name=<optimized out>, base=<optimized out>, arg=0x7fffffffdb60) [#4] 0x7ffff7f7cc41 → dwfl_getmodules(dwfl=0x5555555de290, callback=0x555555578730 <process_dwflmod>, arg=0x7fffffffdb60, offset=0x0) [#5] 0x55555556b811 → process_file(fd=0x3, fname=0x7fffffffe0a9 "../eu-readelf_hangs/id:000000,src:002851,op:flip4,pos:5048", only_one=0x1) [#6] 0x5555555688de → main(argc=0x3, argv=0x7fffffffdce8) repruduce : eu-readelf -a [poc] -- You are receiving this mail because: You are on the CC list for the bug. ^ permalink raw reply [flat|nested] 3+ messages in thread
* [Bug tools/27501] eu-readelf hang while process crafted file 2021-03-03 3:31 [Bug tools/27501] New: eu-readelf hang while process crafted file polaalemu at gmail dot com @ 2021-03-03 20:49 ` mark at klomp dot org 2023-08-16 14:51 ` mark at klomp dot org 1 sibling, 0 replies; 3+ messages in thread From: mark at klomp dot org @ 2021-03-03 20:49 UTC (permalink / raw) To: elfutils-devel https://sourceware.org/bugzilla/show_bug.cgi?id=27501 Mark Wielaard <mark at klomp dot org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|UNCONFIRMED |RESOLVED CC| |mark at klomp dot org --- Comment #1 from Mark Wielaard <mark at klomp dot org> --- Yeah, that is some real garbled data. We should sanity check the offsets to make sure we don't loop "forever" https://sourceware.org/pipermail/elfutils-devel/2021q1/003607.html commit 480b6fa3662ba8ffeee274bf0d37423413c01e55 Author: Mark Wielaard <mark@klomp.org> Date: Wed Mar 3 21:40:53 2021 +0100 readelf: Sanity check verneed and verdef offsets in handle_symtab. We are going through vna_next, vn_next and vd_next in a while loop. Make sure that all offsets are sane. We don't want things to wrap around so we go in cycles. https://sourceware.org/bugzilla/show_bug.cgi?id=27501 Signed-off-by: Mark Wielaard <mark@klomp.org> -- You are receiving this mail because: You are on the CC list for the bug. ^ permalink raw reply [flat|nested] 3+ messages in thread
* [Bug tools/27501] eu-readelf hang while process crafted file 2021-03-03 3:31 [Bug tools/27501] New: eu-readelf hang while process crafted file polaalemu at gmail dot com 2021-03-03 20:49 ` [Bug tools/27501] " mark at klomp dot org @ 2023-08-16 14:51 ` mark at klomp dot org 1 sibling, 0 replies; 3+ messages in thread From: mark at klomp dot org @ 2023-08-16 14:51 UTC (permalink / raw) To: elfutils-devel https://sourceware.org/bugzilla/show_bug.cgi?id=27501 --- Comment #2 from Mark Wielaard <mark at klomp dot org> --- Apparently someone created a CVE for this bug: https://nvd.nist.gov/vuln/detail/CVE-2021-33294 Note that we don't consider this a security issue: https://sourceware.org/cgit/elfutils/tree/SECURITY Since most elfutils tools are run in short-lived, local, interactive, development context rather than remotely "in production", we generally treat malfunctions as ordinary bugs rather than security vulnerabilities. -- You are receiving this mail because: You are on the CC list for the bug. ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-08-16 14:51 UTC | newest] Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2021-03-03 3:31 [Bug tools/27501] New: eu-readelf hang while process crafted file polaalemu at gmail dot com 2021-03-03 20:49 ` [Bug tools/27501] " mark at klomp dot org 2023-08-16 14:51 ` mark at klomp dot org
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).