Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Double free security issue #15

Closed
clod81 opened this issue Oct 12, 2017 · 1 comment
Closed

Double free security issue #15

clod81 opened this issue Oct 12, 2017 · 1 comment

Comments

@clod81
Copy link

clod81 commented Oct 12, 2017

When attempting to parse a file with the following bytes, a double free occurs.
BD 22 5C 0A 0A

Tested on ubuntu, with ruby 2.4.2.

gdb debug:
gdb --batch -q --ex=r --ex 'back' --ex 'disass $pc, $pc+16' --ex 'info reg' --ex 'quit' --args /usr/local/bin/ruby /data/ccsv/ext/test.rb file_containing_crash_bytes 0</dev/null

gdb output:

*** Error in `/usr/local/bin/ruby': double free or corruption (fasttop): 0x0000000002116b80 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7fb6195c57e5]
/lib/x86_64-linux-gnu/libc.so.6(+0x8037a)[0x7fb6195ce37a]
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x4c)[0x7fb6195d253c]
/data/ccsv/ext/ccsv.so(+0x2f0d)[0x7fb618d33f0d]
/usr/local/lib/libruby.so.2.4(+0x596a98)[0x7fb61a810a98]
/usr/local/lib/libruby.so.2.4(+0x58869b)[0x7fb61a80269b]
/usr/local/lib/libruby.so.2.4(+0x583741)[0x7fb61a7fd741]
/usr/local/lib/libruby.so.2.4(+0x583510)[0x7fb61a7fd510]
/usr/local/lib/libruby.so.2.4(+0x58319b)[0x7fb61a7fd19b]
/usr/local/lib/libruby.so.2.4(+0x5411bf)[0x7fb61a7bb1bf]
/usr/local/lib/libruby.so.2.4(+0x578756)[0x7fb61a7f2756]
/usr/local/lib/libruby.so.2.4(rb_iseq_eval_main+0x838)[0x7fb61a7f5218]
/usr/local/lib/libruby.so.2.4(ruby_run_node+0x339)[0x7fb61a3ff479]
/usr/local/bin/ruby[0x4011d7]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7fb61956e830]
/usr/local/bin/ruby(_start+0x29)[0x401059]
======= Memory map: ========
00400000-00402000 r-xp 00000000 00:32 300                                /usr/local/bin/ruby
00601000-00602000 r--p 00001000 00:32 300                                /usr/local/bin/ruby
00602000-00603000 rw-p 00002000 00:32 300                                /usr/local/bin/ruby
00603000-00613000 rw-p 00000000 00:00 0 
01dae000-02123000 rw-p 00000000 00:00 0                                  [heap]
7fb614000000-7fb614021000 rw-p 00000000 00:00 0 
7fb614021000-7fb618000000 ---p 00000000 00:00 0 
7fb618b1b000-7fb618b31000 r-xp 00000000 00:32 1495                       /lib/x86_64-linux-gnu/libgcc_s.so.1
7fb618b31000-7fb618d30000 ---p 00016000 00:32 1495                       /lib/x86_64-linux-gnu/libgcc_s.so.1
7fb618d30000-7fb618d31000 rw-p 00015000 00:32 1495                       /lib/x86_64-linux-gnu/libgcc_s.so.1
7fb618d31000-7fb618d35000 r-xp 00000000 00:32 1326                       /data/ccsv/ext/ccsv.so
7fb618d35000-7fb618f34000 ---p 00004000 00:32 1326                       /data/ccsv/ext/ccsv.so
7fb618f34000-7fb618f35000 r--p 00003000 00:32 1326                       /data/ccsv/ext/ccsv.so
7fb618f35000-7fb618f36000 rw-p 00004000 00:32 1326                       /data/ccsv/ext/ccsv.so
7fb618f36000-7fb618f46000 r-xp 00000000 00:32 335                        /usr/local/lib/ruby/2.4.0/x86_64-linux/stringio.so
7fb618f46000-7fb619146000 ---p 00010000 00:32 335                        /usr/local/lib/ruby/2.4.0/x86_64-linux/stringio.so
7fb619146000-7fb619147000 r--p 00010000 00:32 335                        /usr/local/lib/ruby/2.4.0/x86_64-linux/stringio.so
7fb619147000-7fb619148000 rw-p 00011000 00:32 335                        /usr/local/lib/ruby/2.4.0/x86_64-linux/stringio.so
7fb619148000-7fb61914a000 r-xp 00000000 00:32 318                        /usr/local/lib/ruby/2.4.0/x86_64-linux/enc/trans/transdb.so
7fb61914a000-7fb619349000 ---p 00002000 00:32 318                        /usr/local/lib/ruby/2.4.0/x86_64-linux/enc/trans/transdb.so
7fb619349000-7fb61934a000 r--p 00001000 00:32 318                        /usr/local/lib/ruby/2.4.0/x86_64-linux/enc/trans/transdb.so
7fb61934a000-7fb61934b000 rw-p 00002000 00:32 318                        /usr/local/lib/ruby/2.4.0/x86_64-linux/enc/trans/transdb.so
7fb61934b000-7fb61934d000 r-xp 00000000 00:32 316                        /usr/local/lib/ruby/2.4.0/x86_64-linux/enc/encdb.so
7fb61934d000-7fb61954c000 ---p 00002000 00:32 316                        /usr/local/lib/ruby/2.4.0/x86_64-linux/enc/encdb.so
7fb61954c000-7fb61954d000 r--p 00001000 00:32 316                        /usr/local/lib/ruby/2.4.0/x86_64-linux/enc/encdb.so
7fb61954d000-7fb61954e000 rw-p 00002000 00:32 316                        /usr/local/lib/ruby/2.4.0/x86_64-linux/enc/encdb.so
7fb61954e000-7fb61970e000 r-xp 00000000 00:32 43                         /lib/x86_64-linux-gnu/libc-2.23.so
7fb61970e000-7fb61990e000 ---p 001c0000 00:32 43                         /lib/x86_64-linux-gnu/libc-2.23.so
7fb61990e000-7fb619912000 r--p 001c0000 00:32 43                         /lib/x86_64-linux-gnu/libc-2.23.so
7fb619912000-7fb619914000 rw-p 001c4000 00:32 43                         /lib/x86_64-linux-gnu/libc-2.23.so
7fb619914000-7fb619918000 rw-p 00000000 00:00 0 
7fb619918000-7fb619a20000 r-xp 00000000 00:32 139                        /lib/x86_64-linux-gnu/libm-2.23.so
7fb619a20000-7fb619c1f000 ---p 00108000 00:32 139                        /lib/x86_64-linux-gnu/libm-2.23.so
7fb619c1f000-7fb619c20000 r--p 00107000 00:32 139                        /lib/x86_64-linux-gnu/libm-2.23.so
7fb619c20000-7fb619c21000 rw-p 00108000 00:32 139                        /lib/x86_64-linux-gnu/libm-2.23.so
7fb619c21000-7fb619c2a000 r-xp 00000000 00:32 305                        /lib/x86_64-linux-gnu/libcrypt-2.23.so
7fb619c2a000-7fb619e29000 ---p 00009000 00:32 305                        /lib/x86_64-linux-gnu/libcrypt-2.23.so
7fb619e29000-7fb619e2a000 r--p 00008000 00:32 305                        /lib/x86_64-linux-gnu/libcrypt-2.23.so
7fb619e2a000-7fb619e2b000 rw-p 00009000 00:32 305                        /lib/x86_64-linux-gnu/libcrypt-2.23.so
7fb619e2b000-7fb619e59000 rw-p 00000000 00:00 0 
7fb619e59000-7fb619e5c000 r-xp 00000000 00:32 41                         /lib/x86_64-linux-gnu/libdl-2.23.so
7fb619e5c000-7fb61a05b000 ---p 00003000 00:32 41                         /lib/x86_64-linux-gnu/libdl-2.23.so
7fb61a05b000-7fb61a05c000 r--p 00002000 00:32 41                         /lib/x86_64-linux-gnu/libdl-2.23.so
7fb61a05c000-7fb61a05d000 rw-p 00003000 00:32 41                         /lib/x86_64-linux-gnu/libdl-2.23.so
7fb61a05d000-7fb61a075000 r-xp 00000000 00:32 85                         /lib/x86_64-linux-gnu/libpthread-2.23.so
7fb61a075000-7fb61a274000 ---p 00018000 00:32 85                         /lib/x86_64-linux-gnu/libpthread-2.23.so
7fb61a274000-7fb61a275000 r--p 00017000 00:32 85                         /lib/x86_64-linux-gnu/libpthread-2.23.so
7fb61a275000-7fb61a276000 rw-p 00018000 00:32 85                         /lib/x86_64-linux-gnu/libpthread-2.23.so
7fb61a276000-7fb61a27a000 rw-p 00000000 00:00 0 
7fb61a27a000-7fb61a905000 r-xp 00000000 00:32 303                        /usr/local/lib/libruby.so.2.4.2
7fb61a905000-7fb61ab05000 ---p 0068b000 00:32 303                        /usr/local/lib/libruby.so.2.4.2
7fb61ab05000-7fb61ab0b000 r--p 0068b000 00:32 303                        /usr/local/lib/libruby.so.2.4.2
7fb61ab0b000-7fb61ab0e000 rw-p 00691000 00:32 303                        /usr/local/lib/libruby.so.2.4.2
7fb61ab0e000-7fb61ab1e000 rw-p 00000000 00:00 0 
7fb61ab1e000-7fb61ab44000 r-xp 00000000 00:32 36                         /lib/x86_64-linux-gnu/ld-2.23.so
7fb61ac04000-7fb61ad3b000 rw-p 00000000 00:00 0 
7fb61ad3c000-7fb61ad3d000 rw-p 00000000 00:00 0 
7fb61ad3d000-7fb61ad3e000 ---p 00000000 00:00 0 
7fb61ad3e000-7fb61ad43000 rw-p 00000000 00:00 0 
7fb61ad43000-7fb61ad44000 r--p 00025000 00:32 36                         /lib/x86_64-linux-gnu/ld-2.23.so
7fb61ad44000-7fb61ad45000 rw-p 00026000 00:32 36                         /lib/x86_64-linux-gnu/ld-2.23.so
7fb61ad45000-7fb61ad46000 rw-p 00000000 00:00 0 
7ffc1a668000-7ffc1ae67000 rw-p 00000000 00:00 0                          [stack]
7ffc1ae6a000-7ffc1ae6c000 r--p 00000000 00:00 0                          [vvar]
7ffc1ae6c000-7ffc1ae6e000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
During startup program terminated with signal SIGABRT, Aborted.
@G-Rath
Copy link

G-Rath commented Feb 2, 2023

This has been reported as GHSA-5gxp-c379-pj42 - is it possible get a new release with the fix so we can update?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants