[Bug tools/27501] New: eu-readelf hang while process crafted file

[Bug tools/27501] New: eu-readelf hang while process crafted file

[polaalemu at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27501

            Bug ID: 27501
           Summary: eu-readelf hang while process crafted file
           Product: elfutils
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: tools
          Assignee: unassigned at sourceware dot org
          Reporter: polaalemu at gmail dot com
                CC: elfutils-devel at sourceware dot org
  Target Milestone: ---

Created attachment 13276
  --> https://sourceware.org/bugzilla/attachment.cgi?id=13276&action=edit
hang test case

Hi,
A hang was found in  readelf  v0.183 (the latest commit 35e49c) in function
handle_symtab in readelf.c


it seems verneed will always loop ,I didn't analysis deeply.



bt
[#0] 0x55555556a2d3 → handle_symtab(shdr=0x7fffffffd600, scn=0x5555555dfa58,
ebl=<optimized out>)
[#1] 0x55555556a2d3 → print_symtab(ebl=<optimized out>, type=0xb)
[#2] 0x555555575b95 → process_elf_file(dwflmod=0x5555555de300, fd=<optimized
out>)
[#3] 0x555555578761 → process_dwflmod(dwflmod=0x5555555de300,
userdata=<optimized out>, name=<optimized out>, base=<optimized out>,
arg=0x7fffffffdb60)
[#4] 0x7ffff7f7cc41 → dwfl_getmodules(dwfl=0x5555555de290,
callback=0x555555578730 <process_dwflmod>, arg=0x7fffffffdb60, offset=0x0)
[#5] 0x55555556b811 → process_file(fd=0x3, fname=0x7fffffffe0a9
"../eu-readelf_hangs/id:000000,src:002851,op:flip4,pos:5048", only_one=0x1)
[#6] 0x5555555688de → main(argc=0x3, argv=0x7fffffffdce8)


repruduce :   eu-readelf -a [poc]

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug tools/27501] eu-readelf hang while process crafted file

[mark at klomp dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27501

Mark Wielaard <mark at klomp dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|UNCONFIRMED                 |RESOLVED
                 CC|                            |mark at klomp dot org

--- Comment #1 from Mark Wielaard <mark at klomp dot org> ---
Yeah, that is some real garbled data. We should sanity check the offsets to
make sure we don't loop "forever"

https://sourceware.org/pipermail/elfutils-devel/2021q1/003607.html

commit 480b6fa3662ba8ffeee274bf0d37423413c01e55
Author: Mark Wielaard <mark@klomp.org>
Date:   Wed Mar 3 21:40:53 2021 +0100

    readelf: Sanity check verneed and verdef offsets in handle_symtab.

    We are going through vna_next, vn_next and vd_next in a while loop.
    Make sure that all offsets are sane. We don't want things to wrap
    around so we go in cycles.

    https://sourceware.org/bugzilla/show_bug.cgi?id=27501

    Signed-off-by: Mark Wielaard <mark@klomp.org>

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug tools/27501] eu-readelf hang while process crafted file

[mark at klomp dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27501

--- Comment #2 from Mark Wielaard <mark at klomp dot org> ---
Apparently someone created a CVE for this bug:
https://nvd.nist.gov/vuln/detail/CVE-2021-33294

Note that we don't consider this a security issue:
https://sourceware.org/cgit/elfutils/tree/SECURITY

  Since most elfutils tools are run in short-lived, local, interactive,
  development context rather than remotely "in production", we generally
  treat malfunctions as ordinary bugs rather than security vulnerabilities.

-- 
You are receiving this mail because:
You are on the CC list for the bug.