Bug 21310 - eu-elflint: heap-based buffer overflow in check_symtab_shndx (elflint.c)
Summary: eu-elflint: heap-based buffer overflow in check_symtab_shndx (elflint.c)
Status: RESOLVED FIXED
Alias: None
Product: elfutils
Classification: Unclassified
Component: tools (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-03-27 10:35 UTC by Agostino Sarubbo
Modified: 2018-08-17 04:08 UTC (History)
3 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:


Attachments
stacktrace (2.25 KB, text/plain)
2017-03-27 10:35 UTC, Agostino Sarubbo
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo 2017-03-27 10:35:37 UTC
Created attachment 9944 [details]
stacktrace

On elfutils-0.168:

# eu-elflint -d $FILE
READ of size 4 at 0x60200000efd0 thread T0
    #0 0x4267eb in check_symtab_shndx /tmp/portage/dev-libs/elfutils-0.168/work/elfutils-0.168/src/elflint.c:1961

Compiled with: gcc-6.3.0

Reproducer:
https://github.com/asarubbo/poc/blob/master/00234-elfutils-heapoverflow-check_symtab_shndx

Stacktrace attached.
Comment 1 Mark Wielaard 2017-03-27 22:00:21 UTC
eu-elflint isn't very robust against totally bogus ELF data, but this issue is easy to fix:
https://sourceware.org/ml/elfutils-devel/2017-q1/msg00129.html
Comment 2 Mark Wielaard 2017-04-03 22:16:28 UTC
commit 9a0d9d314a6342b56e3277bd7ad7ecb6e73a7d38
Author: Mark Wielaard <mark@klomp.org>
Date:   Mon Mar 27 23:59:02 2017 +0200

    elflint: Check symbol table data is big enough before checking.
    
    Before checking symbol index zero we should make sure the data size
    is big enough.
    
    https://sourceware.org/bugzilla/show_bug.cgi?id=21310
    
    Signed-off-by: Mark Wielaard <mark@klomp.org>
Comment 3 Mark Wielaard 2017-04-03 22:30:24 UTC
Pushed
Comment 4 Agostino Sarubbo 2017-04-10 07:36:07 UTC
Mitre assigned CVE-2017-7611 to this issue.