XXD Binary EBCDIC Mode Combination Memory Corruption

[err2zero]

Steps to reproduce

XXD Binary EBCDIC Mode Combination Memory Corruption

Summary

During fuzzing of the xxd (hex dump) utility, a critical memory corruption vulnerability was discovered in the combined binary and EBCDIC mode processing logic. The vulnerability occurs when xxd processes files with both binary output (-b) and EBCDIC character encoding (-E) flags simultaneously, leading to segmentation faults due to improper memory management during format conversion operations.

Technical Details

• Vulnerability Type: Segmentation Fault / Memory Corruption
• Affected Function: __memmove_avx_unaligned_erms
• Source File: memmove-vec-unaligned-erms.S
• Line Number: 317
• Signal: SIGSEGV (11)

Vulnerability Mechanism and Root Cause

This memory corruption vulnerability occurs in xxd's mode combination logic when binary and EBCDIC modes are used together. The root cause lies in conflicting memory management between binary formatting routines and EBCDIC character conversion routines.

The vulnerability is triggered when:

1. xxd processes input file with both -b (binary output) and -E (EBCDIC encoding) flags
2. The program attempts to convert binary data to EBCDIC representation while maintaining binary format
3. Due to conflicting buffer management between these two modes, memory allocation/deallocation becomes inconsistent
4. The binary formatter and EBCDIC converter access overlapping memory regions with different size assumptions
5. A subsequent memmove operation attempts to copy data with corrupted buffer parameters
6. This results in an out-of-bounds memory access at __memmove_avx_unaligned_erms+317

The memory corruption occurs when xxd tries to format binary output while simultaneously performing EBCDIC character conversion, leading to buffer overflow conditions.

Proof of Concept

The vulnerability can be triggered by executing xxd with combined binary and EBCDIC mode flags on specific input data that exposes the buffer management conflict.

POC Download: POC_xxd_binary_ebcdic_segfault

Reproduction Steps

1. Compile xxd with debugging symbols enabled
2. Execute: ./xxd -a -b -E -g 256 POC_xxd_binary_ebcdic_segfault
3. The program will crash with a segmentation fault in memmove operation

Credit

• Xudong Cao (UCAS)
• Meng Xu (UW)

Expected behaviour

Segmentation Fault / Memory Corruption

Version of Vim

vim-9.1.0000 and related xxd versions (latest master branch)

Environment

1. Compile xxd with debugging symbols enabled
2. clang && asan

Logs and stack traces

## GDB Debug Output


=== PROGRAM_EXECUTION_START ===
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
__memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:317

=== PROGRAM_EXECUTION_END ===

=== PRIMARY_CRASH_DETECTION ===
Program status from 'info program':
	Using the running image of child Thread 0x7ffff7d81780 (LWP 842231).
Program stopped at 0x7ffff7f247cd.
It stopped with signal SIGSEGV, Segmentation fault.

=== SIGNAL_CRASH_DETECTED ===
Program terminated by signal - this is a genuine crash

=== FRAME_ANALYSIS ===
Valid frame found - program stopped at signal

=== BACKTRACE_ANALYSIS ===
#0  __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:317
#1  0x0000555555561a1d in ?? ()
#2  0x000055555555fdb2 in ?? ()
#3  0x00007ffff7dadd90 in __libc_start_call_main (main=main@entry=0x55555555d0b0, argc=argc@entry=7, argv=argv@entry=0x7fffffffe418) at ../sysdeps/nptl/libc_start_call_main.h:58
#4  0x00007ffff7dade40 in __libc_start_main_impl (main=0x55555555d0b0, argc=7, argv=0x7fffffffe418, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe408) at ../csu/libc-start.c:392
#5  0x00005555555593b5 in ?? ()

=== RECURSION_ANALYSIS ===
Extracted 5 function names from stack trace

=== FINAL_STATUS_DETERMINATION ===
CONCLUSION: Program crashed due to signal
This is a genuine crash requiring investigation
317	../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S: No such file or directory.

[chrisbra]

same here, cannot reproduce.

[err2zero]

same here, cannot reproduce.

hi, here is an introduction to the details of our build:

• System: Ubuntu 22.04, Linux 5.4.0-216-generic, glibc 2.35
  • Source: vim commit c4bca1d-Jul9 (July 2025)
  • Toolchain: Clang 16.0.6, LLD 16.0.6, GCC 11.4.0 runtime
  • Flags: -g -O2 -fno-omit-frame-pointer
  • Binary: ELF 64-bit PIE executable with debug info, dynamically linked to standard glibc
    This configuration uses LLVM toolchain (clang/LLD) instead of GCC/GNU ld

[err2zero]

I tried compiling with clang and gcc, but no crash occurred. It only worked when I used the fuzzer instrumentation.