Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Multiple heap out-of-bounds reads in asn1.c #2966

Closed
m4drat opened this issue Aug 22, 2022 · 1 comment · Fixed by #2977
Closed

Multiple heap out-of-bounds reads in asn1.c #2966

m4drat opened this issue Aug 22, 2022 · 1 comment · Fixed by #2977
Milestone
0.4.1

Comments

@m4drat
Copy link

m4drat commented Aug 22, 2022

Hi! We've been fuzzing your project and found the following errors in /librz/util/asn1.c

Work environment

OS: Ubuntu 20.04
File format: -
rizin version: 4b38597

Bug description

Heap out-of-bounds read of size 1 in /librz/util/asn1.c:81:38 and heap out-of-bounds read of size 21 in librz/util/asn1.c:165:2

Steps to reproduce

  1. Build docker container from https://github.com/ispras/oss-sydr-fuzz/tree/master/projects/rizin: sudo docker build -t oss-sydr-fuzz-rizin .

  2. Run docker container: sudo docker run --privileged --network host -v /etc/localtime:/etc/localtime:ro --rm -it -v $PWD:/fuzz oss-sydr-fuzz-rizin /bin/bash

  3. Execute rizin with crashing input (1):
    /rizin-fuzzing/libfuzzer-asan/bin/rizin -qq crash-39fe0fb1bab0551bbc4038ec30056824

  4. You will see the following output:

    =================================================================
==2524941==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6080000b10fa at pc 0x000001340f0c bp 0x7ffe4e0b1a20 sp 0x7ffe4e0b1a18
READ of size 1 at 0x6080000b10fa thread T0
    #0 0x1340f0b in asn1_parse_header /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/util/asn1.c:81:38
    #1 0x134090f in rz_asn1_count_objects /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/util/asn1.c:107:12
    #2 0x134090f in rz_asn1_create_object /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/util/asn1.c:129:16
    #3 0x1340a17 in rz_asn1_create_object /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/util/asn1.c:139:26
    #4 0x136d586 in rz_pkcs7_parse_spcinfo /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/util/pkcs7.c:692:24
    #5 0xcfe866 in Pe32_bin_pe_init_security /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/format/pe/pe_security.c:134:19
    #6 0xcb0cc5 in bin_pe_init /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/format/pe/pe.c:69:2
    #7 0xcb0cc5 in Pe32_rz_bin_pe_new_buf /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/format/pe/pe.c:126:7
    #8 0xb50cd5 in load_buffer /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/p/bin_pe.inc:25:37
    #9 0xae7004 in rz_bin_object_new /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/bobj.c:300:8
    #10 0xad7d31 in rz_bin_file_new_from_buffer /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/bfile.c:150:19
    #11 0xadf3c7 in rz_bin_open_buf /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/bin.c:272:8
    #12 0xadec27 in rz_bin_open_io /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/bin.c:330:18
    #13 0x1003353 in core_file_do_load_for_io_plugin /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/core/cfile.c:727:23
    #14 0x1003353 in rz_core_bin_load /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/core/cfile.c:974:4
    #15 0x5b9af8 in rz_main_rizin /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/main/rizin.c:1119:14
    #16 0x7f8651859082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #17 0x41da3d in _start (/home/madrat/Desktop/rizin-report/rz-installation-asan/bin/rizin+0x41da3d)

0x6080000b10fa is located 0 bytes to the right of 90-byte region [0x6080000b10a0,0x6080000b10fa)
allocated by thread T0 here:
    #0 0x498e12 in calloc (/home/madrat/Desktop/rizin-report/rz-installation-asan/bin/rizin+0x498e12)
    #1 0x1341118 in rz_asn1_create_binary /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/util/asn1.c:156:20

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/util/asn1.c:81:38 in asn1_parse_header
Shadow bytes around the buggy address:
0x0c108000e1c0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 05
0x0c108000e1d0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
0x0c108000e1e0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
0x0c108000e1f0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
0x0c108000e200: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c108000e210: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00[02]
0x0c108000e220: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c108000e230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c108000e240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c108000e250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c108000e260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable:           00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone:       fa
Freed heap region:       fd
Stack left redzone:      f1
Stack mid redzone:       f2
Stack right redzone:     f3
Stack after return:      f5
Stack use after scope:   f8
Global redzone:          f9
Global init order:       f6
Poisoned by user:        f7
Container overflow:      fc
Array cookie:            ac
Intra object redzone:    bb
ASan internal:           fe
Left alloca redzone:     ca
Right alloca redzone:    cb
Shadow gap:              cc
==2524941==ABORTING

  5. Execute rizin with crashing input (2):
    /rizin-fuzzing/libfuzzer-asan/bin/rizin -qq crash-2d4901d5033d609045e1deed56381ad5f109bcf8

  6. You will see the following output:

    =================================================================
==2524770==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6080000b0e7a at pc 0x000000498047 bp 0x7ffc00bea5f0 sp 0x7ffc00be9db8
READ of size 21 at 0x6080000b0e7a thread T0
    #0 0x498046 in __asan_memcpy (/home/madrat/Desktop/rizin-report/rz-installation-asan/bin/rizin+0x498046)
    #1 0x1341145 in rz_asn1_create_binary /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/util/asn1.c:165:2
    #2 0x136d8de in rz_pkcs7_parse_spcmessagedigest /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/util/pkcs7.c:670:26
    #3 0x136d8de in rz_pkcs7_parse_spcinfo /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/util/pkcs7.c:705:8
    #4 0xcfe866 in Pe32_bin_pe_init_security /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/format/pe/pe_security.c:134:19
    #5 0xcb0cc5 in bin_pe_init /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/format/pe/pe.c:69:2
    #6 0xcb0cc5 in Pe32_rz_bin_pe_new_buf /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/format/pe/pe.c:126:7
    #7 0xb50cd5 in load_buffer /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/p/bin_pe.inc:25:37
    #8 0xae7004 in rz_bin_object_new /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/bobj.c:300:8
    #9 0xad7d31 in rz_bin_file_new_from_buffer /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/bfile.c:150:19
    #10 0xadf3c7 in rz_bin_open_buf /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/bin.c:272:8
    #11 0xadec27 in rz_bin_open_io /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/bin.c:330:18
    #12 0x1003353 in core_file_do_load_for_io_plugin /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/core/cfile.c:727:23
    #13 0x1003353 in rz_core_bin_load /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/core/cfile.c:974:4
    #14 0x5b9af8 in rz_main_rizin /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/main/rizin.c:1119:14
    #15 0x7ff3ba63e082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #16 0x41da3d in _start (/home/madrat/Desktop/rizin-report/rz-installation-asan/bin/rizin+0x41da3d)

0x6080000b0e7a is located 0 bytes to the right of 90-byte region [0x6080000b0e20,0x6080000b0e7a)
allocated by thread T0 here:
    #0 0x498e12 in calloc (/home/madrat/Desktop/rizin-report/rz-installation-asan/bin/rizin+0x498e12)
    #1 0x1341118 in rz_asn1_create_binary /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/util/asn1.c:156:20

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/madrat/Desktop/rizin-report/rz-installation-asan/bin/rizin+0x498046) in __asan_memcpy
Shadow bytes around the buggy address:
0x0c108000e170: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
0x0c108000e180: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 05
0x0c108000e190: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
0x0c108000e1a0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
0x0c108000e1b0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c108000e1c0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00[02]
0x0c108000e1d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c108000e1e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c108000e1f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c108000e200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c108000e210: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable:           00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone:       fa
Freed heap region:       fd
Stack left redzone:      f1
Stack mid redzone:       f2
Stack right redzone:     f3
Stack after return:      f5
Stack use after scope:   f8
Global redzone:          f9
Global init order:       f6
Poisoned by user:        f7
Container overflow:      fc
Array cookie:            ac
Intra object redzone:    bb
ASan internal:           fe
Left alloca redzone:     ca
Right alloca redzone:    cb
Shadow gap:              cc
==2524770==ABORTING

Crashes:

  1. crash-39fe0fb1bab0551bbc4038ec30056824.zip
  2. crash-2d4901d5033d609045e1deed56381ad5f109bcf8.zip
wargio added a commit that referenced this issue Aug 22, 2022
@wargio
fix #2966 #2967 #2974 - oob read in asn1.c
0aaffa4
@wargio wargio mentioned this issue Aug 22, 2022
Closed
5 tasks
wargio added a commit that referenced this issue Aug 23, 2022
@wargio
fix #2966 #2967 #2974 - oob read in asn1.c
e8252f5 
aaa
wargio added a commit that referenced this issue Aug 23, 2022
@wargio
fix #2966 #2967 #2974 - oob read in asn1.c
47a7326
@wargio wargio mentioned this issue Aug 23, 2022
Merged
5 tasks
@m4drat
Copy link
Author

m4drat commented Aug 23, 2022

Additional crashing sample:

  1. crash-925a5a725f154e7ce295163656fbad45f27e3438.zip

wargio added a commit that referenced this issue Aug 23, 2022
@wargio
fix #2966 #2967 #2974 - oob read in asn1.c
aad6564
wargio added a commit that referenced this issue Aug 23, 2022
@wargio
fix #2966 #2967 #2974 - oob read in asn1.c
41f4d56
imbillow pushed a commit that referenced this issue Aug 24, 2022
@wargio @imbillow
fix #2966 #2967 #2974 - oob read in asn1.c
74c6292
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
0.4.1
Development

Successfully merging a pull request may close this issue.

Fix multiple vulnerabilities rizinorg/rizin
Fix multiple vulns rizinorg/rizin
2 participants
@XVilka @m4drat