[<prev] [next>] [day] [month] [year] [list]
Message-ID: <5995128.rBqAYY1dqO@arcadia>
Date: Sat, 04 Feb 2017 13:20:17 +0100
From: Agostino Sarubbo <ago@...too.org>
To: oss-security@...ts.openwall.com
Subject: pax-utils: dumpelf: multiple divide-by-zero in dumpelf.c
Description:
pax-utils is a set of tools that check files for security relevant properties.
A fuzz on dumpelf shows multiple divide-by-zero . They was reported to vapier
which fixed the issues immediately.
Unfortunately I can’t get the ASan stacktrace, so I will show only the
useful(not at all) part of the crash.
# dumpelf $FILE
FPE on unknown address 0x00000051ca65 (pc 0x00000051ca65 bp 0x7ffc31bb6f80 sp
0x7ffc31bb6e40 T0)
Reproducer:
https://github.com/asarubbo/poc/blob/master/00137-pax-utils-dumpelf-fpe1
# dumpelf $FILE
FPE on unknown address 0x00000051d335 (pc 0x00000051d335 bp 0x7ffc17babf80
sp 0x7ffc17babe40 T0)
Reproducer:
https://github.com/asarubbo/poc/blob/master/00138-pax-utils-dumpelf-fpe2
# dumpelf $FILE
FPE on unknown address 0x00000051db76 (pc 0x00000051db76 bp 0x7ffdf90fff80
sp 0x7ffdf90ffe40 T0)
Reproducer:
https://github.com/asarubbo/poc/blob/master/00139-pax-utils-dumpelf-fpe3
Affected version:
1.2.2
Fixed version:
N/A
Commit fix:
https://github.com/gentoo/pax-utils/commit/4609f57a690b4a5670baeb93167dab5300d07d4e
Credit:
These bugs were discovered by Agostino Sarubbo of Gentoo.
CVE:
N/A
Timeline:
2017-01-30: bug discovered and reported to upstream
2017-02-01: upstream released a patch
2017-02-04: blog post about the issue
Note:
These bugs were found with American Fuzzy Lop.
Permalink:
https://blogs.gentoo.org/ago/2017/02/04/pax-utils-dumpelf-multiple-divide-by-zero-in-dumpelf-c
--
Agostino Sarubbo
Gentoo Linux Developer
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
