Created attachment 13276 [details] hang test case Hi, A hang was found in readelf v0.183 (the latest commit 35e49c) in function handle_symtab in readelf.c it seems verneed will always loop ,I didn't analysis deeply. bt [#0] 0x55555556a2d3 → handle_symtab(shdr=0x7fffffffd600, scn=0x5555555dfa58, ebl=<optimized out>) [#1] 0x55555556a2d3 → print_symtab(ebl=<optimized out>, type=0xb) [#2] 0x555555575b95 → process_elf_file(dwflmod=0x5555555de300, fd=<optimized out>) [#3] 0x555555578761 → process_dwflmod(dwflmod=0x5555555de300, userdata=<optimized out>, name=<optimized out>, base=<optimized out>, arg=0x7fffffffdb60) [#4] 0x7ffff7f7cc41 → dwfl_getmodules(dwfl=0x5555555de290, callback=0x555555578730 <process_dwflmod>, arg=0x7fffffffdb60, offset=0x0) [#5] 0x55555556b811 → process_file(fd=0x3, fname=0x7fffffffe0a9 "../eu-readelf_hangs/id:000000,src:002851,op:flip4,pos:5048", only_one=0x1) [#6] 0x5555555688de → main(argc=0x3, argv=0x7fffffffdce8) repruduce : eu-readelf -a [poc]
Yeah, that is some real garbled data. We should sanity check the offsets to make sure we don't loop "forever" https://sourceware.org/pipermail/elfutils-devel/2021q1/003607.html commit 480b6fa3662ba8ffeee274bf0d37423413c01e55 Author: Mark Wielaard <mark@klomp.org> Date: Wed Mar 3 21:40:53 2021 +0100 readelf: Sanity check verneed and verdef offsets in handle_symtab. We are going through vna_next, vn_next and vd_next in a while loop. Make sure that all offsets are sane. We don't want things to wrap around so we go in cycles. https://sourceware.org/bugzilla/show_bug.cgi?id=27501 Signed-off-by: Mark Wielaard <mark@klomp.org>
Apparently someone created a CVE for this bug: https://nvd.nist.gov/vuln/detail/CVE-2021-33294 Note that we don't consider this a security issue: https://sourceware.org/cgit/elfutils/tree/SECURITY Since most elfutils tools are run in short-lived, local, interactive, development context rather than remotely "in production", we generally treat malfunctions as ordinary bugs rather than security vulnerabilities.