Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Created attachment 1298063[details]
Triggered by "./bison $POC"
Description of problem:
The vulnerability was triggered in function fetch_type_name () at src/scan-code.l:609.
Version-Release number of selected component (if applicable):
<= latest version
How reproducible:
./bison POC1
Steps to Reproduce:
The information is as follows:
$./bison POC1
POC1: error: symbol p is used, but is not defined as a token and has no rules
%%D:p{?ˉ?:p{$}D->S:}D%%h:{
^
Segmentation fault
The ASAN debugging information is as follows:
POC1: error: symbol p is used, but is not defined as a token and has no rules
%%D:p{’?:p{$}D->S:}D%%h:{
^
=================================================================
==51695==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000e664 at pc 0x000000579372 bp 0x7ffc4a0cc990 sp 0x7ffc4a0cc988
READ of size 1 at 0x60300000e664 thread T0
#0 0x579371 (/home/icy/real/bison-3.0.4-asan/install/bin/bison+0x579371)
#1 0x570ae0 (/home/icy/real/bison-3.0.4-asan/install/bin/bison+0x570ae0)
#2 0x563e96 (/home/icy/real/bison-3.0.4-asan/install/bin/bison+0x563e96)
#3 0x51a2c6 (/home/icy/real/bison-3.0.4-asan/install/bin/bison+0x51a2c6)
#4 0x7faf5c0ababf (/lib/x86_64-linux-gnu/libc.so.6+0x20abf)
#5 0x43ced8 (/home/icy/real/bison-3.0.4-asan/install/bin/bison+0x43ced8)
0x60300000e664 is located 0 bytes to the right of 20-byte region [0x60300000e650,0x60300000e664)
allocated by thread T0 here:
#0 0x4c3ea2 (/home/icy/real/bison-3.0.4-asan/install/bin/bison+0x4c3ea2)
#1 0x56fb7c (/home/icy/real/bison-3.0.4-asan/install/bin/bison+0x56fb7c)
#2 0x570ae0 (/home/icy/real/bison-3.0.4-asan/install/bin/bison+0x570ae0)
#3 0x51a2c6 (/home/icy/real/bison-3.0.4-asan/install/bin/bison+0x51a2c6)
Shadow bytes around the buggy address:
0x0c067fff9c70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c067fff9c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c067fff9c90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c067fff9ca0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c067fff9cb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c067fff9cc0: fa fa fa fa fa fa fa fa fa fa 00 00[04]fa fa fa
0x0c067fff9cd0: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fd
0x0c067fff9ce0: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
0x0c067fff9cf0: fd fa fa fa 00 00 00 00 fa fa fd fd fd fa fa fa
0x0c067fff9d00: fd fd fd fd fa fa fd fd fd fd fa fa 00 00 00 00
0x0c067fff9d10: fa fa fd fd fd fa fa fa 00 00 00 00 fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==51695==ABORTING
The vulnerability was triggered in function fetch_type_name () at src/scan-code.l:609
599 static
600 char *
601 fetch_type_name (char *cp, char const **type_name,
602 location dollar_loc)
603 {
604 if (*cp == '<')
605 {
606 *type_name = ++cp;
607 /* Series of non-'>' or "->". */
608 while (*cp != '>' || cp[-1] == '-')
609 ++cp;
610
611 /* The '>' symbol will be later replaced by '\0'. Original
612 'text' is needed for error messages. */
613 ++cp;
614 if (untyped_var_seen)
615 complain (&dollar_loc, complaint,
616 _("explicit type given in untyped grammar"));
617 tag_seen = true;
618 }
619 return cp;
620 }
Actual results:
crash
Expected results:
crash
Additional info:
This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact ganshuitao and chaoz.cn if you need more info about the team, the tool or the vulnerability.
I recently rebased bison to 3.6.4 on Rawhide, and tested for this crash on Fedora 32 and Rawhide:
bison-3.5-2.fc32 segfaults
bison-3.6.4-1.fc33 correctly reports an error and exits
This is no more reproducible in bison-3.6.4, which is in Fedora/Rawhide.
Several crashes were reported upstream in March 2020 and fixed prior to release:
https://lists.gnu.org/r/bug-bison/2020-03/threads.html
Considering that this input is generated by a fuzzer and that bison is a development tool,
I'd say that having this fixed in Rawhide is good enough.
So I bisected for this and it appears that it was fixed by the following commit:
commit 641e326303753575664ca146fee7e9148d6bf5cf
Author: Akim Demaille <address@hidden>
Date: Fri Mar 6 09:05:52 2020 +0100
code: be robust to reference with invalid tags
Because we want to support $<a->b>$, we must accept -> in type tags,
and reject $<->$, as it is unfinished.
Reported by Ahcheong Lee.
* src/scan-code.l (yylex): Make sure "tag" does not end with -, since
-> does not close the tag.
* tests/input.at (Stray $ or @): Check this.
This fix was the result of the following upstream bug report by Ahcheong Lee:
https://lists.gnu.org/r/bug-bison/2020-03/msg00009.html
That SIGSEGV was also the finding of a (different) fuzzer but the input is
quite different.
Ahcheong made multiple reports in March 2020 and if I understand correctly,
CVE-2020-14150 was assigned to one/more of of these reports.
Thank you for filing this report.
This bug is now fixed in Fedora Rawhide and will eventually make it to a future
release of RHEL.
Since this is a crash induced by fuzzed input (in the form of code) and the input
causes bison itself to crash and isn't a security flaw in generated code itself,
it is not likely to impact a running service.
Considering the above, we do not plan to fix this in an update to RHEL-8.
Please re-open this bug and associate a customer ticket to revisit this decision.
Created attachment 1298063 [details] Triggered by "./bison $POC" Description of problem: The vulnerability was triggered in function fetch_type_name () at src/scan-code.l:609. Version-Release number of selected component (if applicable): <= latest version How reproducible: ./bison POC1 Steps to Reproduce: The information is as follows: $./bison POC1 POC1: error: symbol p is used, but is not defined as a token and has no rules %%D:p{?ˉ?:p{$}D->S:}D%%h:{ ^ Segmentation fault The ASAN debugging information is as follows: POC1: error: symbol p is used, but is not defined as a token and has no rules %%D:p{’?:p{$}D->S:}D%%h:{ ^ ================================================================= ==51695==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000e664 at pc 0x000000579372 bp 0x7ffc4a0cc990 sp 0x7ffc4a0cc988 READ of size 1 at 0x60300000e664 thread T0 #0 0x579371 (/home/icy/real/bison-3.0.4-asan/install/bin/bison+0x579371) #1 0x570ae0 (/home/icy/real/bison-3.0.4-asan/install/bin/bison+0x570ae0) #2 0x563e96 (/home/icy/real/bison-3.0.4-asan/install/bin/bison+0x563e96) #3 0x51a2c6 (/home/icy/real/bison-3.0.4-asan/install/bin/bison+0x51a2c6) #4 0x7faf5c0ababf (/lib/x86_64-linux-gnu/libc.so.6+0x20abf) #5 0x43ced8 (/home/icy/real/bison-3.0.4-asan/install/bin/bison+0x43ced8) 0x60300000e664 is located 0 bytes to the right of 20-byte region [0x60300000e650,0x60300000e664) allocated by thread T0 here: #0 0x4c3ea2 (/home/icy/real/bison-3.0.4-asan/install/bin/bison+0x4c3ea2) #1 0x56fb7c (/home/icy/real/bison-3.0.4-asan/install/bin/bison+0x56fb7c) #2 0x570ae0 (/home/icy/real/bison-3.0.4-asan/install/bin/bison+0x570ae0) #3 0x51a2c6 (/home/icy/real/bison-3.0.4-asan/install/bin/bison+0x51a2c6) Shadow bytes around the buggy address: 0x0c067fff9c70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9c90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9ca0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9cb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c067fff9cc0: fa fa fa fa fa fa fa fa fa fa 00 00[04]fa fa fa 0x0c067fff9cd0: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fd 0x0c067fff9ce0: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd 0x0c067fff9cf0: fd fa fa fa 00 00 00 00 fa fa fd fd fd fa fa fa 0x0c067fff9d00: fd fd fd fd fa fa fd fd fd fd fa fa 00 00 00 00 0x0c067fff9d10: fa fa fd fd fd fa fa fa 00 00 00 00 fa fa fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==51695==ABORTING The vulnerability was triggered in function fetch_type_name () at src/scan-code.l:609 599 static 600 char * 601 fetch_type_name (char *cp, char const **type_name, 602 location dollar_loc) 603 { 604 if (*cp == '<') 605 { 606 *type_name = ++cp; 607 /* Series of non-'>' or "->". */ 608 while (*cp != '>' || cp[-1] == '-') 609 ++cp; 610 611 /* The '>' symbol will be later replaced by '\0'. Original 612 'text' is needed for error messages. */ 613 ++cp; 614 if (untyped_var_seen) 615 complain (&dollar_loc, complaint, 616 _("explicit type given in untyped grammar")); 617 tag_seen = true; 618 } 619 return cp; 620 } Actual results: crash Expected results: crash Additional info: This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact ganshuitao and chaoz.cn if you need more info about the team, the tool or the vulnerability.