New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use-after-free in sized_string_cmp() #658

Closed
fumfel opened this Issue May 12, 2017 · 0 comments

Comments

Projects
None yet
2 participants
@fumfel

fumfel commented May 12, 2017

Use-after-free in sized_string_cmp()

Git HEAD: eef165b

Payload

To reproduce: yara yara_uaf_sized_string_cmp.yar strings

ASAN:

==18452==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000000450 at pc 0x0000005ac75e bp 0x7fff366d71b0 sp 0x7fff366d71a8
READ of size 4 at 0x604000000450 thread T0
    #0 0x5ac75d in sized_string_cmp XYZ/yara/libyara/sizedstr.c:39:14
    #1 0x58cca4 in yr_execute_code XYZ/yara/libyara/exec.c:1096:21
    #2 0x536784 in yr_rules_scan_mem_blocks XYZ/yara/libyara/rules.c:472:3
    #3 0x537b80 in yr_rules_scan_mem XYZ/yara/libyara/rules.c:586:10
    #4 0x537b80 in yr_rules_scan_file XYZ/yara/libyara/rules.c:610
    #5 0x4f6084 in main XYZ/yara/yara.c:1229:14
    #6 0x7f0ac130e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #7 0x41a7d8 in _start (/usr/local/bin/yara+0x41a7d8)

0x604000000450 is located 0 bytes inside of 44-byte region [0x604000000450,0x60400000047c)
freed by thread T0 here:
    #0 0x4c23c2 in __interceptor_free (/usr/local/bin/yara+0x4c23c2)
    #1 0x514c93 in yr_object_set_string XYZ/yara/libyara/object.c:1048:5
    #2 0x56bd9d in data_md5 XYZ/yara/libyara/modules/hash.c
    #3 0x593434 in yr_execute_code XYZ/yara/libyara/exec.c:572:22
    #4 0x536784 in yr_rules_scan_mem_blocks XYZ/yara/libyara/rules.c:472:3
    #5 0x537b80 in yr_rules_scan_mem XYZ/yara/libyara/rules.c:586:10
    #6 0x537b80 in yr_rules_scan_file XYZ/yara/libyara/rules.c:610
    #7 0x4f6084 in main XYZ/yara/yara.c:1229:14
    #8 0x7f0ac130e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

previously allocated by thread T0 here:
    #0 0x4c26f3 in malloc (/usr/local/bin/yara+0x4c26f3)
    #1 0x514cab in yr_object_set_string XYZ/yara/libyara/object.c:1052:41
    #2 0x56bd9d in data_md5 XYZ/yara/libyara/modules/hash.c
    #3 0x593434 in yr_execute_code XYZ/yara/libyara/exec.c:572:22
    #4 0x536784 in yr_rules_scan_mem_blocks XYZ/yara/libyara/rules.c:472:3
    #5 0x537b80 in yr_rules_scan_mem XYZ/yara/libyara/rules.c:586:10
    #6 0x537b80 in yr_rules_scan_file XYZ/yara/libyara/rules.c:610
    #7 0x4f6084 in main XYZ/yara/yara.c:1229:14
    #8 0x7f0ac130e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-use-after-free XYZ/yara/libyara/sizedstr.c:39:14 in sized_string_cmp
Shadow bytes around the buggy address:
  0x0c087fff8030: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c087fff8040: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 fa
  0x0c087fff8050: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c087fff8060: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c087fff8070: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 01 fa
=>0x0c087fff8080: fa fa 00 00 00 00 00 fa fa fa[fd]fd fd fd fd fd
  0x0c087fff8090: fa fa 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
  0x0c087fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==18452==ABORTING

plusvic added a commit that referenced this issue May 14, 2017

@plusvic plusvic closed this May 14, 2017

CaldurG pushed a commit to CaldurG/yara that referenced this issue Jul 14, 2017

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment