Multiple memory corruption in gprof (binuitils-2.30-15ubuntu1)

[Sergej Schumilo]

Dear all,
The following binutils gprof memory corruptions were found by a modified version of the kAFL fuzzer (https://github.com/RUB-SysSec/kAFL). I have attached the crashing inputs and each ASAN report.

Steps to reproduce:

Build current verison of binutils:
```
pull-lp-source binutils
cd binutils-2.30
CC=clang CXX=clang++ CFLAGS="-fsanitize=address -fsanitize-recover=address -ggdb" CXXFLAGS="-fsanitize=address -fsanitize-recover=address -ggdb" LDFLAGS="-fsanitize=address" ./configure
CC=clang CXX=clang++ CFLAGS="-fsanitize=address -fsanitize-recover=address -ggdb" CXXFLAGS="-fsanitize=address
-fsanitize-recover=address -ggdb" LDFLAGS="-fsanitize=address" make
```

Run inputs under ASAN:

```
ASAN_OPTIONS=halt_on_error=false:allow_addr2line=true ./gprof $file
```

We can verify those issues for gprof binuitils-2.30-15ubuntu1 (Ubuntu 16.04.4 LTS / sources from "pull-lp-source bintuils").

Credits: Sergej Schumilo, Cornelius Aschermann (both of Ruhr-Universität Bochum)

Best regards,
Sergej Schumilo

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better.

Please report this issue to the upstream binutils developers by filing a bug at https://sourceware.org/bugzilla/

Once the binutils team has evaluated the issue, and a proper fix is available, we will release a security update for Ubuntu.

[Sergej Schumilo (schumilo)]

Reported to binutils developers:
https://sourceware.org/bugzilla/show_bug.cgi?id=23056

[Launchpad Janitor (janitor)]

This bug was fixed in the package binutils - 2.30-20ubuntu2

---------------
binutils (2.30-20ubuntu2) cosmic; urgency=medium

  * Fix PR gprof/23056, memory corruption in gprof. LP: #1763098.
  * Fix PR binutils/23054, memory corruption in as. LP: #1763096.
  * Fix PR ld/23055, memory corruption in ld. LP: #1763094.

binutils (2.30-20ubuntu1) cosmic; urgency=medium

  * Merge with Debian; remaining changes:
    - Build from upstream sources.

binutils (2.30-20) unstable; urgency=medium

  * Update, taken from the 2.30 branch 20180516.
    - Fix PR binutils/23109, disassembly mask for vector sdot on AArch64.
    - Fix uninitialised memory acccess in COFF bfd backend.
    - Update Portuguese translations.

binutils (2.30-19) unstable; urgency=medium

  * Build-depend on procps.

 -- Matthias Klose <email address hidden> Wed, 16 May 2018 13:03:58 -0400

[Łukasz Zemczak (sil2100)]

Hello Sergej, or anyone else affected,

Accepted binutils into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/binutils/2.30-21ubuntu1~18.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Łukasz Zemczak (sil2100)]

This bug is already fixed in the latest version present in bionic-security - marking as verified.

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for binutils has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package binutils - 2.30-21ubuntu1~18.04

---------------
binutils (2.30-21ubuntu1~18.04) bionic-proposed; urgency=medium

  * SRU: LP: #1769657
  * Build cross packages for armel, armhf, arm64 on ppc64el.

binutils (2.30-21ubuntu1) cosmic; urgency=medium

  * Merge with Debian; remaining changes:
    - Build from upstream sources.

binutils (2.30-21) unstable; urgency=medium

  * Update, taken from the 2.30 branch 20180529.
    - x86-64: Add TLSDESC fields to elf_x86_lazy_plt_layout.
    - PR binutils/23199, mark section in a section group with SHF_GROUP.
    - PR ld/23194, x86: Don't set eh->local_ref to 1 for versioned symbol.
    - PR ld/23189, x86: Don't set eh->local_ref to 1 for linker defined symbols.
    - PR binutils/23199, Invalid SHT_GROUP entry leads to group confusion.
  * Fix PR gprof/23056, memory corruption in gprof. LP: #1763098.
  * Fix PR binutils/23054, memory corruption in as. LP: #1763096.
  * Fix PR ld/23055, memory corruption in ld. LP: #1763094.

 -- Matthias Klose <email address hidden> Wed, 12 Sep 2018 17:38:08 +0200