CVE-2006-4146 GDB buffer overflow in dwarf stack handling

[Kees Cook]

breezy, dapper, edgy are vulnerable. Patch is available from
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=204845

[Kees Cook (kees)]

Here is a proof-of-concept executable I created, which has a modified .debug_info section that overflows the DWARF2 reader, as outlined in the CVE.

[Kees Cook (kees)]

Source to proof-of-concept. After compiling, using a hexeditor, I overwrote "kapow"s location operator (hex values 0x050304980408) with 0xC2 (new length) 0x3a (push value 10), then 0xC1 more bytes of value 0x12 (DW_OP_dup, which fills the stack with prior stack value).

[Kees Cook (kees)]

Patch, based on the Google-recommended patch. This corrected patch allows for stacki==0, which is a valid state.

[Martin Pitt (pitti)]

http://www.ubuntu.com/usn/usn-356-1

[Martin Pitt (pitti)]

Uploaded edgy version with your patch as well.