Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SEGV in yasm/libyasm/intnum.c's function :yasm_intnum_copy #233

Closed
ChanStormstout opened this issue Jun 29, 2023 · 0 comments · Fixed by #234
Closed

SEGV in yasm/libyasm/intnum.c's function :yasm_intnum_copy #233

ChanStormstout opened this issue Jun 29, 2023 · 0 comments · Fixed by #234

Comments

@ChanStormstout
Copy link

Description

While fuzzing yasm, a SEGV occured which was positioned in yasm/libyasm/intnum.c:399:19 in yasm_intnum_copy.
This bug may allow attackers to cause a crash or denial of service via a designed crafted files.

Operating system

Ubuntu 20.04.6 LTS

ASAN info

./bin/yasm -p gas -f elf32 -g dwarf2 ./out/default/crashes/id\:000035\,sig\:11\,src\:000071\,time\:10629\,execs\:3296\,op\:havoc\,rep\:4 
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1770==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x555a0d6a722a bp 0x7fff3af67550 sp 0x7fff3af67530 T0)
==1770==The signal is caused by a READ memory access.
==1770==Hint: address points to the zero page.
    #0 0x555a0d6a722a in yasm_intnum_copy /AFLplusplus/my_test/yasm/libyasm/intnum.c:399:19
    #1 0x555a0d7b66b4 in elf_symtab_write_to_file /AFLplusplus/my_test/yasm/modules/objfmts/elf/elf.c:485:25
    #2 0x555a0d7a723b in elf_objfmt_output /AFLplusplus/my_test/yasm/modules/objfmts/elf/elf-objfmt.c:812:23
    #3 0x555a0d65e8cd in do_assemble /AFLplusplus/my_test/yasm/frontends/yasm/yasm.c:668:5
    #4 0x7feef6770d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d)
    #5 0x7feef6770e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d)
    #6 0x555a0d58e004 in _start (/AFLplusplus/my_test/fuzz_yasm/bin/yasm+0x183004) (BuildId: 74b4f28840ac06c5)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /AFLplusplus/my_test/yasm/libyasm/intnum.c:399:19 in yasm_intnum_copy
==1770==ABORTING

Steps to Reproduce

./yasm -p gas -f elf32 -g dwarf2 $FILE

Poc

https://github.com/ChanStormstout/Pocs/blob/master/yasm_POC/out/default/crashes/id%3A000035%2Csig%3A11%2Csrc%3A000071%2Ctime%3A10629%2Cexecs%3A3296%2Cop%3Ahavoc%2Crep%3A4
@PeterJohnson PeterJohnson mentioned this issue Jun 30, 2023
Merged
kraj pushed a commit to YoeDistro/meta-openembedded that referenced this issue Aug 18, 2023
@SoumyaWind @kraj
yasm: fix CVE-2023-37732
fef9ae9 
Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c
and /elf/elf.c, which allows the attacker to cause a denial of service via a
crafted file.

References:
yasm/yasm#233
https://nvd.nist.gov/vuln/detail/CVE-2023-37732

Signed-off-by: Soumya <soumya.sambu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
kraj pushed a commit to YoeDistro/meta-openembedded that referenced this issue Aug 18, 2023
@SoumyaWind @kraj
yasm: fix CVE-2023-37732
671abb4 
Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c
and /elf/elf.c, which allows the attacker to cause a denial of service via a
crafted file.

References:
yasm/yasm#233
https://nvd.nist.gov/vuln/detail/CVE-2023-37732

Signed-off-by: Soumya <soumya.sambu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
kraj pushed a commit to YoeDistro/meta-openembedded that referenced this issue Aug 18, 2023
@SoumyaWind @kraj
yasm: fix CVE-2023-37732
2bce731 
Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c
and /elf/elf.c, which allows the attacker to cause a denial of service via a
crafted file.

References:
yasm/yasm#233
https://nvd.nist.gov/vuln/detail/CVE-2023-37732

Signed-off-by: Soumya <soumya.sambu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
kraj pushed a commit to YoeDistro/meta-openembedded that referenced this issue Aug 19, 2023
@SoumyaWind @kraj
yasm: fix CVE-2023-37732
7eb403f 
Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c
and /elf/elf.c, which allows the attacker to cause a denial of service via a
crafted file.

References:
yasm/yasm#233
https://nvd.nist.gov/vuln/detail/CVE-2023-37732

Signed-off-by: Soumya <soumya.sambu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
kraj pushed a commit to YoeDistro/meta-openembedded that referenced this issue Aug 19, 2023
@SoumyaWind @kraj
yasm: fix CVE-2023-37732
30a4419 
Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c
and /elf/elf.c, which allows the attacker to cause a denial of service via a
crafted file.

References:
yasm/yasm#233
https://nvd.nist.gov/vuln/detail/CVE-2023-37732

Signed-off-by: Soumya <soumya.sambu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
kraj pushed a commit to YoeDistro/meta-openembedded that referenced this issue Aug 19, 2023
@SoumyaWind @kraj
yasm: fix CVE-2023-37732
76912f2 
Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c
and /elf/elf.c, which allows the attacker to cause a denial of service via a
crafted file.

References:
yasm/yasm#233
https://nvd.nist.gov/vuln/detail/CVE-2023-37732

Signed-off-by: Soumya <soumya.sambu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
halstead pushed a commit to openembedded/meta-openembedded that referenced this issue Sep 3, 2023
@SoumyaWind @akuster
yasm: fix CVE-2023-37732
41fffef 
Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c
and /elf/elf.c, which allows the attacker to cause a denial of service via a
crafted file.

References:
yasm/yasm#233
https://nvd.nist.gov/vuln/detail/CVE-2023-37732

Signed-off-by: Soumya <soumya.sambu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
halstead pushed a commit to openembedded/meta-openembedded that referenced this issue Jan 12, 2024
@SoumyaWind @akuster
yasm: fix CVE-2023-37732
7f5ded2 
Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c
and /elf/elf.c, which allows the attacker to cause a denial of service via a
crafted file.

References:
yasm/yasm#233
https://nvd.nist.gov/vuln/detail/CVE-2023-37732

Signed-off-by: Soumya <soumya.sambu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 41fffef)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
jpuhlman pushed a commit to MontaVista-OpenSourceTechnology/meta-openembedded that referenced this issue Jan 16, 2024
@SoumyaWind @jpuhlman
yasm: fix CVE-2023-37732
6bb97bd 
Source: meta-openembedded
MR: 129773
Type: Integration
Disposition: Merged from meta-openembedded
ChangeID: 7f5ded2
Description:

Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c
and /elf/elf.c, which allows the attacker to cause a denial of service via a
crafted file.

References:
yasm/yasm#233
https://nvd.nist.gov/vuln/detail/CVE-2023-37732

Signed-off-by: Soumya <soumya.sambu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 41fffef)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>
sgunin pushed a commit to sgunin/oe-meta-openembedded-contrib that referenced this issue Mar 17, 2024
@SoumyaWind @akuster
yasm: fix CVE-2023-37732
dace297 
Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c
and /elf/elf.c, which allows the attacker to cause a denial of service via a
crafted file.

References:
yasm/yasm#233
https://nvd.nist.gov/vuln/detail/CVE-2023-37732

Signed-off-by: Soumya <soumya.sambu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 41fffef)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

elf.c: Fix NULL deref on bad xsize expression PeterJohnson/yasm
1 participant
@ChanStormstout