Skip to content

8-byte Out of Bounds Write onto the Heap #196

Closed
@WhatTheFuzz

Description

@WhatTheFuzz

Found a small faulting test case for pcre2test that causes a segmentation fault on some architectures (x86). It looks like the fault is in process_data. The logic for filling ovector may be off by one. Specifically, the offending line is

for (j = 0; j < 2*oveccount; j++) ovector[j] = JUNK_OFFSET;

in the file:line pcre2test.c:7634

# Show compiler and arch. 
$ clang --version
Ubuntu clang version 14.0.0-1ubuntu1
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/bin

# Compile with ASAN to show the bug on amd64 platforms. On x86 (-m32), it crashes.
$ CC=clang CFLAGS="-fsanitize=address -Og -ggdb" LD_FLAGS="-fsanitize=address" ./autogen.sh
$ CC=clang CFLAGS="-fsanitize=address -Og -ggdb" LD_FLAGS="-fsanitize=address" ./configure
$ CC=clang CFLAGS="-fsanitize=address -Og -ggdb" LD_FLAGS="-fsanitize=address" make

# Show exploitation mitigations.
$ checksec .libs/pcre2test 
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      PIE enabled
    ASAN:     Enabled
    UBSAN:    Enabled
    
$  .libs/pcre2test  ./80271ad5c66883facd8415181d5c632ff297b23a45a70760d831d2d8cd4a6ddd /dev/null
=================================================================
==134099==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000000180 at pc 0x5619337c3587 bp 0x7ffcc068faf0 sp 0x7ffcc068fae8
WRITE of size 8 at 0x612000000180 thread T0
    #0 0x5619337c3586 in process_data pcre2/src/pcre2test.c:7634:48
    #1 0x5619337b7ec7 in main pcre2/src/pcre2test.c:9441:12
    #2 0x7f548e8e1d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #3 0x7f548e8e1e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #4 0x5619336f7854 in _start (pcre2/.libs/pcre2test+0x3a854) (BuildId: 65d14eea5ad79438d33864f76304278584ff1b06)

0x612000000180 is located 0 bytes to the right of 320-byte region [0x612000000040,0x612000000180)
allocated by thread T0 here:
    #0 0x56193377a69e in __interceptor_malloc (pcre2/.libs/pcre2test+0xbd69e) (BuildId: 65d14eea5ad79438d33864f76304278584ff1b06)
    #1 0x5619337bc2eb in my_malloc pcre2/src/pcre2test.c:2794:15

SUMMARY: AddressSanitizer: heap-buffer-overflow pcre2/src/pcre2test.c:7634:48 in process_data
Shadow bytes around the buggy address:
  0x0c247fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c247fff8030:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==134099==ABORTING

I've attached the faulting test case below. Can anyone confirm they get the same result? Low security implications due to mitigations and the size of the overwrite on the heap.

80271ad5c66883facd8415181d5c632ff297b23a45a70760d831d2d8cd4a6ddd.txt

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions