Bug 23804 - Heap-buffer-overflow problem in function Sec_merge_hash_lookup in merge.c, as demonstrated by "ld -E"
Summary: Heap-buffer-overflow problem in function Sec_merge_hash_lookup in merge.c, as...
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.31
: P2 normal
Target Milestone: 2.32
Assignee: Alan Modra
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-10-21 10:22 UTC by wcventure
Modified: 2018-10-23 11:16 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed: 2018-10-23 00:00:00


Attachments
POC1 (9.83 KB, application/octet-stream)
2018-10-21 10:22 UTC, wcventure
Details
POC2 (3.72 KB, application/x-executable)
2018-10-21 10:23 UTC, wcventure
Details

Note You need to log in before you can comment on or make changes to this bug.
Description wcventure 2018-10-21 10:22:23 UTC
Created attachment 11355 [details]
POC1

Heap-buffer-overflow problem in function Sec_merge_hash_lookup in merge.c, as demonstrated by "ld -E"

Hi, there.

A Heap-buffer-overflow problem was discovered in function Sec_merge_hash_lookup in merge.c of binutils 2.31. This problem can be reproduced in the latest code base, too. A crafted ELF input can cause segment faults and I have confirmed them with address sanitizer too.

Please use the "./ld -E $POC" to reproduce the bug.


The ASAN dumps the stack trace as follows:

> ==6219==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fafe4eca898 at pc 0x0000010a46ef bp 0x7fffeb302450 sp 0x7fffeb302448
> READ of size 1 at 0x7fafe4eca898 thread T0
>     #0 0x10a46ee in sec_merge_hash_lookup bintuils_gdb/bfd/merge.c:166:7
>     #1 0x10a685d in sec_merge_add bintuils_gdb/bfd/merge.c:268:11
>     #2 0x10996e5 in record_section bintuils_gdb/bfd/merge.c:488:12
>     #3 0x10974ed in _bfd_merge_sections bintuils_gdb/bfd/merge.c:751:13
>     #4 0xba24d3 in _bfd_elf_merge_sections bintuils_gdb/bfd/elflink.c:7398:5
>     #5 0x589ea4 in lang_process bintuils_gdb/ld/ldlang.c:7543:7
>     #6 0x5fd19c in main bintuils_gdb/ld/./ldmain.c:438:3
>     #7 0x7fafe409382f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
>     #8 0x419638 in _start (/media/hjwang/01D3344861A8D2E0/wcventure/Project/binutils_latest_ASAN_O0/build/bin/ld+0x419638)
> 
> 0x7fafe4eca898 is located 0 bytes to the right of 131224-byte region [0x7fafe4eaa800,0x7fafe4eca898)
> allocated by thread T0 here:
>     #0 0x4b9748 in malloc (/media/hjwang/01D3344861A8D2E0/wcventure/Project/binutils_latest_ASAN_O0/build/bin/ld+0x4b9748)
>     #1 0x12a243c in _objalloc_alloc bintuils_gdb/libiberty/./objalloc.c:143:22
>     #2 0x83a238 in bfd_alloc bintuils_gdb/bfd/opncls.c:949:9
>     #3 0x1094f3a in _bfd_add_merge_section bintuils_gdb/bfd/merge.c:432:15
>     #4 0xba1cd4 in _bfd_elf_merge_sections bintuils_gdb/bfd/elflink.c:7389:12
>     #5 0x589ea4 in lang_process bintuils_gdb/ld/ldlang.c:7543:7
>     #6 0x5fd19c in main bintuils_gdb/ld/./ldmain.c:438:3
>     #7 0x7fafe409382f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
> 
> SUMMARY: AddressSanitizer: heap-buffer-overflow bintuils_gdb/bfd/merge.c:166:7 in sec_merge_hash_lookup
> Shadow bytes around the buggy address:
>   0x0ff67c9d14c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x0ff67c9d14d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x0ff67c9d14e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x0ff67c9d14f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x0ff67c9d1500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> =>0x0ff67c9d1510: 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0ff67c9d1520: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0ff67c9d1530: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0ff67c9d1540: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0ff67c9d1550: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0ff67c9d1560: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
> Shadow byte legend (one shadow byte represents 8 application bytes):
>   Addressable:           00
>   Partially addressable: 01 02 03 04 05 06 07
>   Heap left redzone:       fa
>   Heap right redzone:      fb
>   Freed heap region:       fd
>   Stack left redzone:      f1
>   Stack mid redzone:       f2
>   Stack right redzone:     f3
>   Stack partial redzone:   f4
>   Stack after return:      f5
>   Stack use after scope:   f8
>   Global redzone:          f9
>   Global init order:       f6
>   Poisoned by user:        f7
>   Container overflow:      fc
>   Array cookie:            ac
>   Intra object redzone:    bb
>   ASan internal:           fe
>   Left alloca redzone:     ca
>   Right alloca redzone:    cb
> ==6219==ABORTING
> Aborted
Comment 1 wcventure 2018-10-21 10:23:36 UTC
Created attachment 11356 [details]
POC2

Please use the "./ld -E $POC" to reproduce the bug.
This bug was discovered by NTU Cyber-Security-Lab. If you have any questions,
please let me know.
Comment 2 cvs-commit@gcc.gnu.org 2018-10-23 10:40:20 UTC
The master branch has been updated by Alan Modra <amodra@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ab419ddbb2cdd17ca83618990f2cacf904ce1d61

commit ab419ddbb2cdd17ca83618990f2cacf904ce1d61
Author: Alan Modra <amodra@gmail.com>
Date:   Tue Oct 23 18:29:24 2018 +1030

    PR23804, buffer overflow in sec_merge_hash_lookup
    
    	PR 23804
    	* merge.c (_bfd_add_merge_section): Don't attempt to merge
    	sections where size is not a multiple of entsize.
Comment 3 Alan Modra 2018-10-23 11:16:04 UTC
Fixed