Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Double Free Vulnerability #123

Closed
blindfuzzy opened this issue Apr 7, 2017 · 9 comments

Comments

Projects
None yet
3 participants
@blindfuzzy
Copy link

commented Apr 7, 2017

Tested against latest updates and the issue still remains.. @marcobambini

I found a Double Free vulnerability while fuzzing Gravity. I have attached the Valgrind output as well. If the crash and/or core dump file is needed let me know and I will get those to you as well.

Gravity_valgrind.txt

ASAN output:

$ ~/Exploit-Dev/TESTS/IN/gravity/gravity '/home/robin/Exploit-Dev/TESTS/OUT/SYNC3/master/crashes/id:000006,sig:06,src:000012,op:ext_AO,pos:201'
RUNTIME ERROR: Unable to find f2 into class foo

==7734==ERROR: AddressSanitizer: attempting double-free on 0x60200000e250 in thread T0:
#0 0x7f12b68432ca in __interceptor_free (/usr/lib/gcc/x86_64-linux-gnu/5/libasan.so+0x982ca)
#1 0x456e19 in gravity_class_free_internal src/shared/gravity_value.c:371
#2 0x456cc7 in gravity_class_free_core src/shared/gravity_value.c:383
#3 0x444323 in gravity_core_free src/runtime/gravity_core.c:2226
#4 0x46a9b1 in main src/cli/gravity.c:234
#5 0x7f12b5ef182f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#6 0x401808 in _start (/home/robin/Exploit-Dev/TESTS/IN/gravity/gravity+0x401808)

0x60200000e250 is located 0 bytes inside of 8-byte region [0x60200000e250,0x60200000e258)
freed by thread T0 here:
#0 0x7f12b68432ca in __interceptor_free (/usr/lib/gcc/x86_64-linux-gnu/5/libasan.so+0x982ca)
#1 0x456e19 in gravity_class_free_internal src/shared/gravity_value.c:371

previously allocated by thread T0 here:
#0 0x7f12b684379a in __interceptor_calloc (/usr/lib/gcc/x86_64-linux-gnu/5/libasan.so+0x9879a)
#1 0x4694e2 in string_dup src/utils/gravity_utils.c:326

SUMMARY: AddressSanitizer: double-free ??:0 __interceptor_free
==7734==ABORTING

POC thanks to @tylerp96 :

Gravity Double Free Vulnerability
4/7/2017

class foo
{
func f1() {return 10;}
}

func main()
{
var obj = foo();
var n1 = obj.f1();

func test() {return 1000;}
Int.bind("test", test);

}

@tylerp96

This comment has been minimized.

Copy link

commented Apr 7, 2017

Gravity Double Free Vulnerability

4/7/2017

class foo
{
	func f1() {return 10;}
}

func main()
{
	var obj = foo();
	var n1 = obj.f1();

	func test() {return 1000;}
	Int.bind("test", test);
	
}
@marcobambini

This comment has been minimized.

Copy link
Owner

commented Apr 7, 2017

Thanks @blindfuzzy and @tylerp96 , this is a very good catch.
In this version core classes are shared among all VM instances and this could be an issue in case of bound methods, so it would be probably a good idea to play safe and forbid bind on core classes.
Fixed by f00c04d

@blindfuzzy

This comment has been minimized.

Copy link
Author

commented Apr 7, 2017

Issue remains after fix same crash file against the latest Gravity as of 20mins ago:

$ ~/Exploit-Dev/TESTS/IN/gravity/gravity '/home/robin/Exploit-Dev/TESTS/OUT/SYNC3/master/crashes.2017-04-07-10:01:44/id:000006,sig:06,src:000012,op:ext_AO,pos:201'
RUNTIME ERROR: Unable to find f2 into class foo

==27199==ERROR: AddressSanitizer: attempting double-free on 0x60200000e250 in thread T0:
#0 0x7f7eda36d2ca in __interceptor_free (/usr/lib/gcc/x86_64-linux-gnu/5/libasan.so+0x982ca)
#1 0x458389 in gravity_class_free_internal src/shared/gravity_value.c:371
#2 0x458237 in gravity_class_free_core src/shared/gravity_value.c:383
#3 0x445883 in gravity_core_free src/runtime/gravity_core.c:2227
#4 0x46c1d1 in main src/cli/gravity.c:234
#5 0x7f7ed9a1b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#6 0x401808 in _start (/home/robin/Exploit-Dev/TESTS/IN/gravity/gravity+0x401808)

0x60200000e250 is located 0 bytes inside of 8-byte region [0x60200000e250,0x60200000e258)
freed by thread T0 here:
#0 0x7f7eda36d2ca in __interceptor_free (/usr/lib/gcc/x86_64-linux-gnu/5/libasan.so+0x982ca)
#1 0x458389 in gravity_class_free_internal src/shared/gravity_value.c:371

previously allocated by thread T0 here:
#0 0x7f7eda36d79a in __interceptor_calloc (/usr/lib/gcc/x86_64-linux-gnu/5/libasan.so+0x9879a)
#1 0x46ad02 in string_dup src/utils/gravity_utils.c:326

SUMMARY: AddressSanitizer: double-free ??:0 __interceptor_free
==27199==ABORTING

Would you like the coredump @marcobambini? This should remain open until it is resolved 100%.

@marcobambini

This comment has been minimized.

Copy link
Owner

commented Apr 7, 2017

@blindfuzzy I just retested again your example and everything worked as expected to me.

@blindfuzzy

This comment has been minimized.

Copy link
Author

commented Apr 7, 2017

@marcobambini this is the test case that is still causing the double free to occur. Anyway I can send you the coredump?

#unittest {
	name: "Bind/unbind test.";
	error: NONE;
	result: 61010;
};

class foo {
	func f1() {return 10;}
}

func main() {
	var obj = foo();
	var n1 = obj.f1();// 10
	
	func test() {return 1000;}
	Int.bind("f2", test);
	var n2 = obj.f2();				//0
	
	obj.bind("f3", {return 10000;});
	var n3 = obj.f3()	// 10000
	
	obj.unbind("f2");
	obj.bind("f2", {return 50000;});
	var n4 = obj.f2();// 5
	
	return n1+n2+n3+n4;
}
@marcobambini

This comment has been minimized.

Copy link
Owner

commented Apr 7, 2017

@blindfuzzy don't you receive a "RUNTIME ERROR: Unable to bind method to a Gravity core class." error?

@blindfuzzy

This comment has been minimized.

Copy link
Author

commented Apr 7, 2017

@marcobambini this is the error after running both with and without ASAN: "RUNTIME ERROR: Unable to find f2 into class foo"

Here is the backtrace of the last crash:

======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7fc1a12a27e5]
/lib/x86_64-linux-gnu/libc.so.6(+0x7fe0a)[0x7fc1a12aae0a]
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x4c)[0x7fc1a12ae98c]
/home/robin/Exploit-Dev/TESTS/IN/gravity/gravity[0x45838a]
/home/robin/Exploit-Dev/TESTS/IN/gravity/gravity[0x458238]
/home/robin/Exploit-Dev/TESTS/IN/gravity/gravity[0x445884]
/home/robin/Exploit-Dev/TESTS/IN/gravity/gravity[0x46c1d2]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7fc1a124b830]
/home/robin/Exploit-Dev/TESTS/IN/gravity/gravity[0x401809]
@marcobambini

This comment has been minimized.

Copy link
Owner

commented Apr 7, 2017

@blindfuzzy I don't think you are running the latest version, there should be a "RUNTIME ERROR: Unable to bind method to a Gravity core class." first.

@blindfuzzy

This comment has been minimized.

Copy link
Author

commented Apr 7, 2017

@marcobambini very strange must of been a delay between the commit and it updating through to me git cloning. I nuked what I had and re-made everything and the issue is resolved now. 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.