Bug 1740615 (CVE-2019-1010180) - CVE-2019-1010180 gdb: buffer overflow while opening an ELF for debugging leads to Dos, information dislosure and code execution
Summary: CVE-2019-1010180 gdb: buffer overflow while opening an ELF for debugging lead...
Keywords:
Status: NEW
Alias: CVE-2019-1010180
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1742099 1740633 1742028
Blocks: 1740622
TreeView+ depends on / blocked
 
Reported: 2019-08-13 11:37 UTC by Marian Rehak
Modified: 2019-08-30 15:05 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Marian Rehak 2019-08-13 11:37:45 UTC
Buffer Overflow - Out of bound memory access in the main gdb module via opening an ELF for debugging with an impact of DoS, Memory Disclosure, and Possible Code Execution.

Comment 1 Marian Rehak 2019-08-13 12:07:26 UTC
Created gdb tracking bugs for this issue:

Affects: fedora-all [bug 1740633]

Comment 10 Marco Benatto 2019-08-16 19:18:49 UTC
The following upstream commit was added to upstream bugzilla entry for this issue:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8ff71a9c80cfcf64c54d4ae938c644b1b1ea19fb

however it's important to notice this commit doesn't properly fix the flaw but only adds a warning instead.

Comment 11 Marco Benatto 2019-08-16 19:23:55 UTC
Currently GDB doesn't properly validate the ELF section sizes from input file. The section size value is used during debug symbols reading phase when gdb extract the symbols and their names from file's string table. The invalid section size generate odd offsets during the table reading in function read_indirect_string_at_offset_from(), the odd offset will lead to a out-of-bands read and may result in data leaks and DoS.

Comment 14 David Smith 2019-08-30 15:05:44 UTC
OK, so Jan and I chatted on IRC about his comment. I was considering using gdb to attach to some running process (which uses ptrace()). Jan was talking about just running just gdb to load some untrusted binary. He was worried about this untrusted binary crashing gdb, and then somehow causing some of the other code in that untrusted binary getting run.

However, as comment #3 says: "On the other hand I can't see how this can lead to arbitrary code execution". Comment #4 says "It doesn't seems possible to cause code execution though".

If there is no possible code execution, Jan and I agree that this is a minor/harmless DoS and should be classified as "low".


Note You need to log in before you can comment on or make changes to this bug.