| Summary: | Fail to detect invalid FDE header, can exhaust gdb process's virtual memory and terminate debug session | ||
|---|---|---|---|
| Product: | gdb | Reporter: | Kang <kanglictf> |
| Component: | backtrace | Assignee: | Not yet assigned to anyone <unassigned> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | sergiodj, simark |
| Priority: | P2 | ||
| Version: | HEAD | ||
| Target Milestone: | --- | ||
| Host: | Target: | ||
| Build: | Last reconfirmed: | ||
| Project(s) to access: | ssh public key: | ||
| Attachments: |
malformed core file
a regular ELF file (cb), used to load with the core file a malformed ELF file sample patch file screenshot or gdb failure when open core file screenshot when gdb fails during debugging attachment-95212-0.html |
||
|
Description
Kang
2017-06-15 02:22:13 UTC
Created attachment 10141 [details]
malformed core file
gdb runs into error when open this file along with the normal binary (the attachment called cb)
Created attachment 10142 [details]
a regular ELF file (cb), used to load with the core file
use gdb to load this ELF and the core file together.
Created attachment 10143 [details]
a malformed ELF file
gdb shows error message after run this with a breakpoint.
Created attachment 10144 [details]
sample patch file
Created attachment 10145 [details]
screenshot or gdb failure when open core file
Created attachment 10146 [details]
screenshot when gdb fails during debugging
Thanks for the bug report. I see you have a possible patch to fix this issue, and it is rather trivial (in the sense that it just modifies a few lines of code). In this case, I would suggest you to submit the patch, along with a description of what it does, to gdb-patches@sourceware.org. We have a wiki page which contains a contribution checklist: https://sourceware.org/gdb/wiki/ContributionChecklist. Thanks. BTW, bug is confirmed on i686 targets. Created attachment 10148 [details] attachment-95212-0.html Got it! Will check how to fix this. On Thu, Jun 15, 2017 at 3:51 PM, sergiodj at redhat dot com < sourceware-bugzilla@sourceware.org> wrote: > https://sourceware.org/bugzilla/show_bug.cgi?id=21600 > > --- Comment #8 from Sergio Durigan Junior <sergiodj at redhat dot com> --- > BTW, bug is confirmed on i686 targets. > > -- > You are receiving this mail because: > You reported the bug. > BTW, we just tested on earlier version of gdb (7.4 & 7.7). The bug affects earlier versions of gdb as well, i.e. malformed/malicious ELF binaries can prevent gdb from debugging by forcing session termination. We will work on a new patch. The master branch has been updated by Sandra Loosemore <sandra@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=723adb650a31859d7cc45832cb8adca0206455ed commit 723adb650a31859d7cc45832cb8adca0206455ed Author: Sandra Loosemore <sandra@codesourcery.com> Date: Thu Apr 25 07:27:02 2019 -0700 Detect invalid length field in debug frame FDE header. GDB was failing to catch cases where a corrupt ELF or core file contained an invalid length value in a Dwarf debug frame FDE header. It was checking for buffer overflow but not cases where the length was negative or caused pointer wrap-around. In addition to the additional validity check, this patch cleans up the multiple signed/unsigned conversions on the length field so that an unsigned representation is used consistently throughout. This patch fixes CVE-2017-9778 and PR gdb/21600. 2019-04-25 Sandra Loosemore <sandra@codesourcery.com> Kang Li <kanglictf@gmail.com> PR gdb/21600 * dwarf2-frame.c (read_initial_length): Be consistent about using unsigned representation of length. (decode_frame_entry_1): Likewise. Check for wraparound of end pointer as well as buffer overflow. Should be fixed by commit mentioned above. |