This service will be undergoing maintenance at 00:00 UTC, 2017-10-23 It is expected to last about 30 minutes
Bug 1470926 - There is a heap-buffer-overflow in tokdel() function of cflow.
There is a heap-buffer-overflow in tokdel() function of cflow.
Status: NEW
Product: Fedora
Classification: Fedora
Component: cflow (Show other bugs)
27
x86_64 Linux
unspecified Severity urgent
: ---
: ---
Assigned To: Terje Røsten
Fedora Extras Quality Assurance
: Reopened
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2017-07-13 22:55 EDT by owl337
Modified: 2017-08-15 05:11 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-07-25 10:30:15 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Triggered by "./cflow $POC" (1.05 KB, application/x-rar)
2017-07-13 22:55 EDT, owl337
no flags Details

  None (edit)
Description owl337 2017-07-13 22:55:31 EDT
Created attachment 1298072 [details]
Triggered by  "./cflow $POC"

Description of problem:

There is a  heap-buffer-overflow in tokdel() function of cflow. 

Version-Release number of selected component (if applicable):

<= latest version

How reproducible:

./cflow POC1

Steps to Reproduce:

The information is as follows:

$./cflow POC1
 
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: size_t redefined
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: this is the place of previous definition
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: size_t redefined
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: this is the place of previous definition
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: size_t redefined
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: this is the place of previous definition
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: size_t redefined
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: this is the place of previous definition
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: size_t redefined
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: this is the place of previous definition
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: size_t redefined
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: this is the place of previous definition
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: size_t redefined
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: this is the place of previous definition
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: size_t redefined
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: this is the place of previous definition
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: size_t redefined
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: this is the place of previous definition
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:51: size_t redefined
./../../../cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: this is the place of previous definition
Segmentation fault

The ASAN debugging  information is as follows:

/home/icy/real/cflow-1.5-asan/cflow-1.5/install/bin/cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: size_t redefined
/home/icy/real/cflow-1.5-asan/cflow-1.5/install/bin/cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: this is the place of previous definition
/home/icy/real/cflow-1.5-asan/cflow-1.5/install/bin/cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: size_t redefined
/home/icy/real/cflow-1.5-asan/cflow-1.5/install/bin/cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: this is the place of previous definition
/home/icy/real/cflow-1.5-asan/cflow-1.5/install/bin/cflow:id:000056,sig:11,src:001424,op:ext_AO,pos:1449:46: size_t redefined
...
=================================================================
==53508==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7ffacabd9400 at pc 0x0000004a9542 bp 0x7ffc3515aea0 sp 0x7ffc3515a658
READ of size 752136 at 0x7ffacabd9400 thread T0
    #0 0x4a9541  (/home/icy/real/cflow-1.5-asan/cflow-1.5/install/bin/cflow+0x4a9541)
    #1 0x4fc8c4  (/home/icy/real/cflow-1.5-asan/cflow-1.5/install/bin/cflow+0x4fc8c4)
    #2 0x4fbc57  (/home/icy/real/cflow-1.5-asan/cflow-1.5/install/bin/cflow+0x4fbc57)
    #3 0x4fb5b5  (/home/icy/real/cflow-1.5-asan/cflow-1.5/install/bin/cflow+0x4fb5b5)
    #4 0x4f2085  (/home/icy/real/cflow-1.5-asan/cflow-1.5/install/bin/cflow+0x4f2085)
    #5 0x7ffad2e28abf  (/lib/x86_64-linux-gnu/libc.so.6+0x20abf)
    #6 0x438938  (/home/icy/real/cflow-1.5-asan/cflow-1.5/install/bin/cflow+0x438938)

0x7ffacabd9400 is located 0 bytes to the right of 752640-byte region [0x7ffacab21800,0x7ffacabd9400)
allocated by thread T0 here:
    #0 0x4bfc45  (/home/icy/real/cflow-1.5-asan/cflow-1.5/install/bin/cflow+0x4bfc45)
    #1 0x52efdc  (/home/icy/real/cflow-1.5-asan/cflow-1.5/install/bin/cflow+0x52efdc)

Shadow bytes around the buggy address:
  0x0fffd9573230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fffd9573240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fffd9573250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fffd9573260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fffd9573270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0fffd9573280:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fffd9573290: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fffd95732a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fffd95732b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fffd95732c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fffd95732d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==53508==ABORTING


The vulnerability was triggered in function tokdel () at parser.c:238,where the value of (end - beg + 1) * sizeof(token_stack[0])) is too big.

233	void
234	tokdel(int beg, int end)
235	{
236	     if (end >= beg) {
237		  if (end < tos)
238		       memmove(token_stack + beg, token_stack + end + 1,
239			       (end - beg + 1) * sizeof(token_stack[0]));
240		  tos -= (end - beg + 1);
241	     }
242	}


Actual results:

crash

Expected results:

crash

Additional info:

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact ganshuitao@gmail.com   and chaoz@tsinghua.edu.cn if you need more info about the team, the tool or the vulnerability.
Comment 3 Jan Kurik 2017-08-15 05:11:27 EDT
This bug appears to have been reported against 'rawhide' during the Fedora 27 development cycle.
Changing version to '27'.

Note You need to log in before you can comment on or make changes to this bug.