23804 – Heap-buffer-overflow problem in function Sec_merge_hash_lookup in merge.c, as demonstrated by "ld -E"

Bug 23804 - Heap-buffer-overflow problem in function Sec_merge_hash_lookup in merge.c, as demonstrated by "ld -E"

Summary: Heap-buffer-overflow problem in function Sec_merge_hash_lookup in merge.c, as...

Status:	RESOLVED FIXED

Alias:	None

Product:	binutils
Classification:	Unclassified
Component:	binutils (show other bugs)
Version:	2.31

Importance:	P2 normal
Target Milestone:	2.32
Assignee:	Alan Modra

URL:
Keywords:

Depends on:
Blocks:

Reported:	2018-10-21 10:22 UTC by wcventure
Modified:	2018-10-23 11:16 UTC (History)
CC List:	0 users

See Also:
Host:
Target:
Build:
Last reconfirmed:	2018-10-23 00:00:00

Attachments
POC1 (9.83 KB, application/octet-stream) 2018-10-21 10:22 UTC, wcventure	Details
POC2 (3.72 KB, application/x-executable) 2018-10-21 10:23 UTC, wcventure	Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description wcventure 2018-10-21 10:22:23 UTC

Created attachment 11355 [details]
POC1

Heap-buffer-overflow problem in function Sec_merge_hash_lookup in merge.c, as demonstrated by "ld -E"

Hi, there.

A Heap-buffer-overflow problem was discovered in function Sec_merge_hash_lookup in merge.c of binutils 2.31. This problem can be reproduced in the latest code base, too. A crafted ELF input can cause segment faults and I have confirmed them with address sanitizer too.

Please use the "./ld -E $POC" to reproduce the bug.


The ASAN dumps the stack trace as follows:

> ==6219==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fafe4eca898 at pc 0x0000010a46ef bp 0x7fffeb302450 sp 0x7fffeb302448
> READ of size 1 at 0x7fafe4eca898 thread T0
>     #0 0x10a46ee in sec_merge_hash_lookup bintuils_gdb/bfd/merge.c:166:7
>     #1 0x10a685d in sec_merge_add bintuils_gdb/bfd/merge.c:268:11
>     #2 0x10996e5 in record_section bintuils_gdb/bfd/merge.c:488:12
>     #3 0x10974ed in _bfd_merge_sections bintuils_gdb/bfd/merge.c:751:13
>     #4 0xba24d3 in _bfd_elf_merge_sections bintuils_gdb/bfd/elflink.c:7398:5
>     #5 0x589ea4 in lang_process bintuils_gdb/ld/ldlang.c:7543:7
>     #6 0x5fd19c in main bintuils_gdb/ld/./ldmain.c:438:3
>     #7 0x7fafe409382f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
>     #8 0x419638 in _start (/media/hjwang/01D3344861A8D2E0/wcventure/Project/binutils_latest_ASAN_O0/build/bin/ld+0x419638)
> 
> 0x7fafe4eca898 is located 0 bytes to the right of 131224-byte region [0x7fafe4eaa800,0x7fafe4eca898)
> allocated by thread T0 here:
>     #0 0x4b9748 in malloc (/media/hjwang/01D3344861A8D2E0/wcventure/Project/binutils_latest_ASAN_O0/build/bin/ld+0x4b9748)
>     #1 0x12a243c in _objalloc_alloc bintuils_gdb/libiberty/./objalloc.c:143:22
>     #2 0x83a238 in bfd_alloc bintuils_gdb/bfd/opncls.c:949:9
>     #3 0x1094f3a in _bfd_add_merge_section bintuils_gdb/bfd/merge.c:432:15
>     #4 0xba1cd4 in _bfd_elf_merge_sections bintuils_gdb/bfd/elflink.c:7389:12
>     #5 0x589ea4 in lang_process bintuils_gdb/ld/ldlang.c:7543:7
>     #6 0x5fd19c in main bintuils_gdb/ld/./ldmain.c:438:3
>     #7 0x7fafe409382f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
> 
> SUMMARY: AddressSanitizer: heap-buffer-overflow bintuils_gdb/bfd/merge.c:166:7 in sec_merge_hash_lookup
> Shadow bytes around the buggy address:
>   0x0ff67c9d14c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x0ff67c9d14d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x0ff67c9d14e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x0ff67c9d14f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x0ff67c9d1500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> =>0x0ff67c9d1510: 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0ff67c9d1520: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0ff67c9d1530: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0ff67c9d1540: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0ff67c9d1550: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0ff67c9d1560: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
> Shadow byte legend (one shadow byte represents 8 application bytes):
>   Addressable:           00
>   Partially addressable: 01 02 03 04 05 06 07
>   Heap left redzone:       fa
>   Heap right redzone:      fb
>   Freed heap region:       fd
>   Stack left redzone:      f1
>   Stack mid redzone:       f2
>   Stack right redzone:     f3
>   Stack partial redzone:   f4
>   Stack after return:      f5
>   Stack use after scope:   f8
>   Global redzone:          f9
>   Global init order:       f6
>   Poisoned by user:        f7
>   Container overflow:      fc
>   Array cookie:            ac
>   Intra object redzone:    bb
>   ASan internal:           fe
>   Left alloca redzone:     ca
>   Right alloca redzone:    cb
> ==6219==ABORTING
> Aborted

Comment 1 wcventure 2018-10-21 10:23:36 UTC

Created attachment 11356 [details]
POC2

Please use the "./ld -E $POC" to reproduce the bug.
This bug was discovered by NTU Cyber-Security-Lab. If you have any questions,
please let me know.

Comment 2 Sourceware Commits 2018-10-23 10:40:20 UTC

The master branch has been updated by Alan Modra <amodra@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ab419ddbb2cdd17ca83618990f2cacf904ce1d61

commit ab419ddbb2cdd17ca83618990f2cacf904ce1d61
Author: Alan Modra <amodra@gmail.com>
Date:   Tue Oct 23 18:29:24 2018 +1030

    PR23804, buffer overflow in sec_merge_hash_lookup
    
    	PR 23804
    	* merge.c (_bfd_add_merge_section): Don't attempt to merge
    	sections where size is not a multiple of entsize.

Comment 3 Alan Modra 2018-10-23 11:16:04 UTC

Fixed