Bug 203875 (CVE-2006-4146)

From: "Will Drewry" <drewry>
Subject: Multiple vulnerabilities in GDB
To: dan, jimb, ezannoni
Cc: cve, vendor-sec
Date: Tue, 15 Aug 2006 18:59:33 +0100
Reply-To: wad

Hi GDB maintainers (et. al.) -

I'm mailing to inform you that I've run across some exploitable
vulnerabilities in GDB.  I've included a simple patch along with
a proof of concept in the advisory below.


The GNU Debugger (GDB) Multiple Vulnerabilities
-----------------------------------------------

Summary
-------

Multiple vulnerabilities have been discovered in the GNU debugger that allow
for the execution of arbitrary code.


Background
----------

GDB is the GNU Project Debugger. It is described on its project page
[http://www.gnu.org/software/gdb/] as allowing "you to see what is going on
`inside' another program while it executes -- or what another program was doing
at the moment it crashed."

DWARF is a information format standard used to represent debugging information
for a specific binary. While the first version was originally used in ELF, ELF
later moved to STABS. In more recent years, DWARF version 2.0 has been
reintroduced into ELF binaries. More information can be found at
http://dwarf.freestandards.org.


Impact
------

A successful exploit would result in the execution of arbitrary code on the
loading of a specially crafted executable.

This a viable mechanism for an attacker to escape restricted environments by
piggybacking exploit code on seeming harmless files often used for debugging.
In the worst case, this could allow for privilege escalation.


Workaround
----------

Do not use GDB on untrusted files that may have DWARF(2) debugging information,
e.g.  binaries and core files. There is no way to verify if an untrusted file
is safe to debug without investigating the debugging symbols manually.


Discussion
----------

Will Drewry <wad> of the Google Security Team has found multiple
exploitable vulnerabilities in the DWARF and DWARF2 code. Initially,
Tavis Ormandy <taviso>, also of the Google Security Team,
discovered a crash condition in GDB related to DWARF2 debugging information.
This discovery led to the further exploration of the condition, and the
discovery of the security implications.

The DWARF specification allows location description blocks containing a list of
operations to be used to determine the final real address for some debugging
symbol. GDB evaluates these operations on an unchecked stack buffer of size 64.
This allows for any location block (DW_FORM_block) with more than 64 operations
to overwrite the current stack frame with arbitrary user-supplied data.  This
behavior occurs in both dwarfread.c and dwarfread2.c.

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2007-0469.html