Bug 21320 - eu-elflint: heap-based buffer overflow in check_group (elflint.c)
Summary: eu-elflint: heap-based buffer overflow in check_group (elflint.c)
Status: RESOLVED FIXED
Alias: None
Product: elfutils
Classification: Unclassified
Component: tools (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-03-28 08:35 UTC by Agostino Sarubbo
Modified: 2017-04-10 07:33 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:

Attachments
stacktrace (3.02 KB, text/plain)
2017-03-28 08:35 UTC, Agostino Sarubbo 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo 2017-03-28 08:35:34 UTC 
Created attachment 9952 [details]
stacktrace

On elfutils-0.168:

# eu-elflint -d $FILE
READ of size 4 at 0x60200000efd0 thread T0
    #0 0x41a39e in check_group /tmp/portage/dev-libs/elfutils-0.168/work/elfutils-0.168/src/elflint.c:2664

Compiled with: gcc-6.3.0

Reproducer:
https://github.com/asarubbo/poc/blob/master/00247-elfutils-heapoverflow-check_group

Stacktrace attached.
Comment 1 Agostino Sarubbo 2017-03-28 08:39:44 UTC 
it can be a duplicate of 21310
Comment 2 Mark Wielaard 2017-03-28 11:33:37 UTC 
elflint: Don't check section group without flags word
https://sourceware.org/ml/elfutils-devel/2017-q1/msg00137.html
Comment 3 Mark Wielaard 2017-04-03 22:28:40 UTC 
commit fb6709f1a41b58a9557ea45b7f53ae678c660b21
Author: Mark Wielaard <mark@klomp.org>
Date:   Tue Mar 28 13:33:03 2017 +0200

    elflint: Don't check section group without flags word.
    
    https://sourceware.org/bugzilla/show_bug.cgi?id=21320
    
    Signed-off-by: Mark Wielaard <mark@klomp.org>
Comment 4 Agostino Sarubbo 2017-04-10 07:33:15 UTC 
Mitre assigned CVE-2017-7610 to this issue.