Bug 21320

Summary: eu-elflint: heap-based buffer overflow in check_group (elflint.c)
Product: elfutils Reporter: Agostino Sarubbo <ago>
Component: toolsAssignee: Not yet assigned to anyone <unassigned>
Status: RESOLVED FIXED    
Severity: normal CC: elfutils-devel, mark
Priority: P2    
Version: unspecified   
Target Milestone: ---   
Host: Target:
Build: Last reconfirmed:
Attachments: stacktrace

Description Agostino Sarubbo 2017-03-28 08:35:34 UTC 
Created attachment 9952 [details]
stacktrace

On elfutils-0.168:

# eu-elflint -d $FILE
READ of size 4 at 0x60200000efd0 thread T0
    #0 0x41a39e in check_group /tmp/portage/dev-libs/elfutils-0.168/work/elfutils-0.168/src/elflint.c:2664

Compiled with: gcc-6.3.0

Reproducer:
https://github.com/asarubbo/poc/blob/master/00247-elfutils-heapoverflow-check_group

Stacktrace attached.
Comment 1 Agostino Sarubbo 2017-03-28 08:39:44 UTC 
it can be a duplicate of 21310
Comment 2 Mark Wielaard 2017-03-28 11:33:37 UTC 
elflint: Don't check section group without flags word
https://sourceware.org/ml/elfutils-devel/2017-q1/msg00137.html
Comment 3 Mark Wielaard 2017-04-03 22:28:40 UTC 
commit fb6709f1a41b58a9557ea45b7f53ae678c660b21
Author: Mark Wielaard <mark@klomp.org>
Date:   Tue Mar 28 13:33:03 2017 +0200

    elflint: Don't check section group without flags word.
    
    https://sourceware.org/bugzilla/show_bug.cgi?id=21320
    
    Signed-off-by: Mark Wielaard <mark@klomp.org>
Comment 4 Agostino Sarubbo 2017-04-10 07:33:15 UTC 
Mitre assigned CVE-2017-7610 to this issue.