Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
There is an illegal address access in dump_entry.c of libncurses.
Version-Release number of selected component (if applicable):
<= latest version
How reproducible:
./infotocap POC12
Steps to Reproduce:
$ ./../../../infotocap POC12
...
:bl=^G:cr=\r:do=\n:i2=:i3=:kb=^H:kd=\n:kl=^H:nw=\r\n:rs=\272:\
:sf=\n:ta=^I:
R裕驭每每:\
:bl=^G:cr=\r:do=\n:i2=:i3=:kb=^H:kd=\n:kl=^H:nw=\r\n:sf=\n:\
:ta=^I:
S裕驭[:\
:bl=^G:cr=\r:do=\n:i2=:i3=:kb=^H:kd=\n:kl=^H:nw=\r\n:sf=\n:\
:ta=^I:
j裕驭[:\
:bl=^G:cr=\r:do=\n:kb=^H:kd=\n:kl=^H:nw=\r\n:sf=\n:ta=^I:
Segmentation fault
The GDB debugging information is as follows:
(gdb) set args POC6
(gdb) r
Starting program: /home/icy/secreal/ncurses-6.0-20170819/install/bin/infotocap POC6
"POC6", line 1, col 9: dubious character `*' in name or alias field
"POC6", line 1, col 10, terminal 'a*9拢驭[': Illegal character (expected alphanumeric or @%&*!#) - '['
"POC6", line 1, col 14, terminal 'a*9拢驭[': unknown capability 'O'
"POC6", line 1, col 21, terminal 'a*9拢驭[': unknown capability '5'
...
Breakpoint 1, fmt_entry (tterm=0x686700, pred=<optimized out>, content_only=<optimized out>, suppress_untranslatable=0,
infodump=0, numbers=0) at ../progs/dump_entry.c:996
996 && !strcmp(reset_2string, termcap_reset))
(gdb) c
Continuing.
j:\
:bl=^G:cr=\r:do=\n:kb=^H:kd=\n:kl=^H:nw=\r\n:rs=:sf=\n:ta=^I:
j裕詧拢[M:\
:bl=^G:cr=\r:do=\n:i2=:i3=:kb=^H:kd=\n:kl=^H:nw=\r\n:rs=\272:\
:sf=\n:ta=^I:
S裕驭[:\
:bl=^G:cr=\r:do=\n:kb=^H:kd=\n:kl=^H:nw=\r\n:rs=\272:sf=\n:\
:ta=^I:
R裕驭每每:\
:bl=^G:cr=\r:do=\n:i2=:i3=:kb=^H:kd=\n:kl=^H:nw=\r\n:sf=\n:\
:ta=^I:
j裕詧[M:\
:bl=^G:cr=\r:do=\n:i2=:i3=:kb=^H:kd=\n:kl=^H:nw=\r\n:rs=\272:\
:sf=\n:ta=^I:
R裕驭每每:\
:bl=^G:cr=\r:do=\n:i2=:i3=:kb=^H:kd=\n:kl=^H:nw=\r\n:sf=\n:\
:ta=^I:
S裕驭[:\
:bl=^G:cr=\r:do=\n:i2=:i3=:kb=^H:kd=\n:kl=^H:nw=\r\n:sf=\n:\
:ta=^I:
j裕驭[:\
:bl=^G:cr=\r:do=\n:kb=^H:kd=\n:kl=^H:nw=\r\n:sf=\n:ta=^I:
Breakpoint 1, fmt_entry (tterm=0x68f600, pred=<optimized out>, content_only=<optimized out>, suppress_untranslatable=0,
infodump=0, numbers=0) at ../progs/dump_entry.c:996
996 && !strcmp(reset_2string, termcap_reset))
(gdb) bt
#0 fmt_entry (tterm=0x68f600, pred=<optimized out>, content_only=<optimized out>, suppress_untranslatable=0,
infodump=0, numbers=0) at ../progs/dump_entry.c:996
#1 0x00000000004195df in dump_entry (tterm=0x68f600, suppress_untranslatable=0, limited=1, numbers=0, pred=0x0)
at ../progs/dump_entry.c:1513
#2 0x0000000000403e74 in main (argc=<optimized out>, argv=<optimized out>) at ../progs/tic.c:1032
(gdb) n
Program received signal SIGSEGV, Segmentation fault.
__strcmp_sse2_unaligned () at ../sysdeps/x86_64/multiarch/strcmp-sse2-unaligned.S:201
201 ../sysdeps/x86_64/multiarch/strcmp-sse2-unaligned.S: No such file or directory.
Trigged in:
fmt_entry (tterm=0x68f600, pred=<optimized out>, content_only=<optimized out>, suppress_untranslatable=0,
infodump=0, numbers=0) at ../progs/dump_entry.c:996
996 && !strcmp(reset_2string, termcap_reset))
(gdb) list
991 if (init_3string != ABSENT_STRING
992 && !strcmp(init_3string, termcap_reset))
993 DISCARD(init_3string);
994
995 if (reset_2string != ABSENT_STRING
996 && !strcmp(reset_2string, termcap_reset))
997 DISCARD(reset_2string);
998 }
999 }
1000
Actual results:
crash
Expected results:
crash
Additional info:
Credits:
This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact ganshuitao and chaoz.cn if you need more info about the team, the tool or the vulnerability.
(In reply to Thomas E. Dickey from comment #4)
> The given attachment does not produce the problem.
> By the way, the trace uses a different filename.
Please set it as follow.
$gdb infotocap
...
(gdb) set args POC12
In curses, there are two kinds of invalid string, ABSENT_STRING (char*)0, and CANCELLED_STRING (char *)(-1). However, in ncurses 6.0, a string will be passed to strcmp if it is not an ABSENT_STRING. strcmp call on a CANCELLED_STRING causes a segment fault.
In ncurses-6.0-20171007, macro VALID_STRING check a string for both ABSENT_STRING and CANCELLED_STRING, only a string that is neither a ABSENT_STRING nor a CANCELLED_STRING will be passed to strcmp.
Description of problem: There is an illegal address access in dump_entry.c of libncurses. Version-Release number of selected component (if applicable): <= latest version How reproducible: ./infotocap POC12 Steps to Reproduce: $ ./../../../infotocap POC12 ... :bl=^G:cr=\r:do=\n:i2=:i3=:kb=^H:kd=\n:kl=^H:nw=\r\n:rs=\272:\ :sf=\n:ta=^I: R裕驭每每:\ :bl=^G:cr=\r:do=\n:i2=:i3=:kb=^H:kd=\n:kl=^H:nw=\r\n:sf=\n:\ :ta=^I: S裕驭[:\ :bl=^G:cr=\r:do=\n:i2=:i3=:kb=^H:kd=\n:kl=^H:nw=\r\n:sf=\n:\ :ta=^I: j裕驭[:\ :bl=^G:cr=\r:do=\n:kb=^H:kd=\n:kl=^H:nw=\r\n:sf=\n:ta=^I: Segmentation fault The GDB debugging information is as follows: (gdb) set args POC6 (gdb) r Starting program: /home/icy/secreal/ncurses-6.0-20170819/install/bin/infotocap POC6 "POC6", line 1, col 9: dubious character `*' in name or alias field "POC6", line 1, col 10, terminal 'a*9拢驭[': Illegal character (expected alphanumeric or @%&*!#) - '[' "POC6", line 1, col 14, terminal 'a*9拢驭[': unknown capability 'O' "POC6", line 1, col 21, terminal 'a*9拢驭[': unknown capability '5' ... Breakpoint 1, fmt_entry (tterm=0x686700, pred=<optimized out>, content_only=<optimized out>, suppress_untranslatable=0, infodump=0, numbers=0) at ../progs/dump_entry.c:996 996 && !strcmp(reset_2string, termcap_reset)) (gdb) c Continuing. j:\ :bl=^G:cr=\r:do=\n:kb=^H:kd=\n:kl=^H:nw=\r\n:rs=:sf=\n:ta=^I: j裕詧拢[M:\ :bl=^G:cr=\r:do=\n:i2=:i3=:kb=^H:kd=\n:kl=^H:nw=\r\n:rs=\272:\ :sf=\n:ta=^I: S裕驭[:\ :bl=^G:cr=\r:do=\n:kb=^H:kd=\n:kl=^H:nw=\r\n:rs=\272:sf=\n:\ :ta=^I: R裕驭每每:\ :bl=^G:cr=\r:do=\n:i2=:i3=:kb=^H:kd=\n:kl=^H:nw=\r\n:sf=\n:\ :ta=^I: j裕詧[M:\ :bl=^G:cr=\r:do=\n:i2=:i3=:kb=^H:kd=\n:kl=^H:nw=\r\n:rs=\272:\ :sf=\n:ta=^I: R裕驭每每:\ :bl=^G:cr=\r:do=\n:i2=:i3=:kb=^H:kd=\n:kl=^H:nw=\r\n:sf=\n:\ :ta=^I: S裕驭[:\ :bl=^G:cr=\r:do=\n:i2=:i3=:kb=^H:kd=\n:kl=^H:nw=\r\n:sf=\n:\ :ta=^I: j裕驭[:\ :bl=^G:cr=\r:do=\n:kb=^H:kd=\n:kl=^H:nw=\r\n:sf=\n:ta=^I: Breakpoint 1, fmt_entry (tterm=0x68f600, pred=<optimized out>, content_only=<optimized out>, suppress_untranslatable=0, infodump=0, numbers=0) at ../progs/dump_entry.c:996 996 && !strcmp(reset_2string, termcap_reset)) (gdb) bt #0 fmt_entry (tterm=0x68f600, pred=<optimized out>, content_only=<optimized out>, suppress_untranslatable=0, infodump=0, numbers=0) at ../progs/dump_entry.c:996 #1 0x00000000004195df in dump_entry (tterm=0x68f600, suppress_untranslatable=0, limited=1, numbers=0, pred=0x0) at ../progs/dump_entry.c:1513 #2 0x0000000000403e74 in main (argc=<optimized out>, argv=<optimized out>) at ../progs/tic.c:1032 (gdb) n Program received signal SIGSEGV, Segmentation fault. __strcmp_sse2_unaligned () at ../sysdeps/x86_64/multiarch/strcmp-sse2-unaligned.S:201 201 ../sysdeps/x86_64/multiarch/strcmp-sse2-unaligned.S: No such file or directory. Trigged in: fmt_entry (tterm=0x68f600, pred=<optimized out>, content_only=<optimized out>, suppress_untranslatable=0, infodump=0, numbers=0) at ../progs/dump_entry.c:996 996 && !strcmp(reset_2string, termcap_reset)) (gdb) list 991 if (init_3string != ABSENT_STRING 992 && !strcmp(init_3string, termcap_reset)) 993 DISCARD(init_3string); 994 995 if (reset_2string != ABSENT_STRING 996 && !strcmp(reset_2string, termcap_reset)) 997 DISCARD(reset_2string); 998 } 999 } 1000 Actual results: crash Expected results: crash Additional info: Credits: This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact ganshuitao and chaoz.cn if you need more info about the team, the tool or the vulnerability.