SIGSEGV and out-of-bounds write during processing file via objdump
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| binutils (Ubuntu) |
Expired
|
Undecided
|
Unassigned | ||
Bug Description
SIGSEGV and out-of-bounds write during processing file via objdump
# Description
During processing of the attached elf file via
```
objdump -S testcase
```
an out-of-bounds write is triggered and causes a segmentation fault (SIGSEGV) This allows an attacker to perform a denial of service and possibly opens up other attack vectors if files from untrusted sources are processed.
For reproduction of the crash, I attached the following script(s):
- reproduce-ubuntu.sh : Reproduction on Ubuntu 20.04
Since I was unable to reproduce the bug upstream, I report it here.
If you need further assistance, please do not hesitate to ask.
# Ubuntu version
# apt show binutils
Package: binutils
Version: 2.34-6ubuntu1.3
Priority: optional
Build-Essential: yes
Section: devel
Origin: Ubuntu
Maintainer: Ubuntu Developers <email address hidden>
Original-
Bugs: https:/
Installed-Size: 110 kB
Provides: binutils-gold, elf-binutils
Depends: binutils-common (= 2.34-6ubuntu1.3), libbinutils (= 2.34-6ubuntu1.3), binutils-
Suggests: binutils-doc (>= 2.34-6ubuntu1.3)
Conflicts: binutils-
Homepage: https:/
Task: ubuntustudio-video, ubuntu-mate-core, ubuntu-mate-desktop
Download-Size: 3380 B
APT-Manual-
APT-Sources: http://
Description: GNU assembler, linker and binary utilities
# Ubuntu valgrind
==1== Memcheck, a memory error detector
==1== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==1== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==1== Command: objdump -S /testcase
==1==
objdump: warning: /testcase has a corrupt section with a size (3c3b031b01) larger than the file size
objdump: /testcase: warning: loop in section dependencies detected
objdump: warning: /testcase has a corrupt section with a size (3c3b031b01) larger than the file size
==1== Invalid write of size 4
==1== at 0x4A40248: bfd_section_
==1== by 0x4A3BD4F: bfd_elf64_object_p (in /usr/lib/
==1== by 0x4A1AB01: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1== by 0x111B3C: ??? (in /usr/bin/
==1== by 0x4B360B2: (below main) (libc-start.c:308)
==1== Address 0x4d469f4 is 1,940 bytes inside a block of size 4,064 free'd
==1== at 0x483CA3F: free (in /usr/lib/
==1== by 0x4ABC85B: objalloc_free_block (in /usr/lib/
==1== by 0x4A1AABF: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1== by 0x111B3C: ??? (in /usr/bin/
==1== by 0x4B360B2: (below main) (libc-start.c:308)
==1== Block was alloc'd at
==1== at 0x483B7F3: malloc (in /usr/lib/
==1== by 0x4ABC65B: _objalloc_alloc (in /usr/lib/
==1== by 0x4A227D4: bfd_alloc (in /usr/lib/
==1== by 0x4A22CED: bfd_zalloc (in /usr/lib/
==1== by 0x4A41DE9: _bfd_elf_
==1== by 0x4A2485E: ??? (in /usr/lib/
==1== by 0x4A40CEB: _bfd_elf_
==1== by 0x4A401DE: bfd_section_
==1== by 0x4A3BD4F: bfd_elf64_object_p (in /usr/lib/
==1== by 0x4A1AB01: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1==
==1== Invalid write of size 4
==1== at 0x4A40248: bfd_section_
==1== by 0x4A4036B: bfd_section_
==1== by 0x4A3BD4F: bfd_elf64_object_p (in /usr/lib/
==1== by 0x4A1AB01: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1== by 0x111B3C: ??? (in /usr/bin/
==1== by 0x4B360B2: (below main) (libc-start.c:308)
==1== Address 0x4d469fc is 1,948 bytes inside a block of size 4,064 free'd
==1== at 0x483CA3F: free (in /usr/lib/
==1== by 0x4ABC85B: objalloc_free_block (in /usr/lib/
==1== by 0x4A1AABF: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1== by 0x111B3C: ??? (in /usr/bin/
==1== by 0x4B360B2: (below main) (libc-start.c:308)
==1== Block was alloc'd at
==1== at 0x483B7F3: malloc (in /usr/lib/
==1== by 0x4ABC65B: _objalloc_alloc (in /usr/lib/
==1== by 0x4A227D4: bfd_alloc (in /usr/lib/
==1== by 0x4A22CED: bfd_zalloc (in /usr/lib/
==1== by 0x4A41DE9: _bfd_elf_
==1== by 0x4A2485E: ??? (in /usr/lib/
==1== by 0x4A40CEB: _bfd_elf_
==1== by 0x4A401DE: bfd_section_
==1== by 0x4A3BD4F: bfd_elf64_object_p (in /usr/lib/
==1== by 0x4A1AB01: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1==
==1== Invalid read of size 4
==1== at 0x4A3FFA4: bfd_section_
==1== by 0x4A4036B: bfd_section_
==1== by 0x4A4036B: bfd_section_
==1== by 0x4A3BD4F: bfd_elf64_object_p (in /usr/lib/
==1== by 0x4A1AB01: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1== by 0x111B3C: ??? (in /usr/bin/
==1== by 0x4B360B2: (below main) (libc-start.c:308)
==1== Address 0x4d46a04 is 1,956 bytes inside a block of size 4,064 free'd
==1== at 0x483CA3F: free (in /usr/lib/
==1== by 0x4ABC85B: objalloc_free_block (in /usr/lib/
==1== by 0x4A1AABF: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1== by 0x111B3C: ??? (in /usr/bin/
==1== by 0x4B360B2: (below main) (libc-start.c:308)
==1== Block was alloc'd at
==1== at 0x483B7F3: malloc (in /usr/lib/
==1== by 0x4ABC65B: _objalloc_alloc (in /usr/lib/
==1== by 0x4A227D4: bfd_alloc (in /usr/lib/
==1== by 0x4A22CED: bfd_zalloc (in /usr/lib/
==1== by 0x4A41DE9: _bfd_elf_
==1== by 0x4A2485E: ??? (in /usr/lib/
==1== by 0x4A40CEB: _bfd_elf_
==1== by 0x4A401DE: bfd_section_
==1== by 0x4A3BD4F: bfd_elf64_object_p (in /usr/lib/
==1== by 0x4A1AB01: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1==
==1== Invalid write of size 4
==1== at 0x4A3FFAE: bfd_section_
==1== by 0x4A4036B: bfd_section_
==1== by 0x4A4036B: bfd_section_
==1== by 0x4A3BD4F: bfd_elf64_object_p (in /usr/lib/
==1== by 0x4A1AB01: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1== by 0x111B3C: ??? (in /usr/bin/
==1== by 0x4B360B2: (below main) (libc-start.c:308)
==1== Address 0x4d46a04 is 1,956 bytes inside a block of size 4,064 free'd
==1== at 0x483CA3F: free (in /usr/lib/
==1== by 0x4ABC85B: objalloc_free_block (in /usr/lib/
==1== by 0x4A1AABF: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1== by 0x111B3C: ??? (in /usr/bin/
==1== by 0x4B360B2: (below main) (libc-start.c:308)
==1== Block was alloc'd at
==1== at 0x483B7F3: malloc (in /usr/lib/
==1== by 0x4ABC65B: _objalloc_alloc (in /usr/lib/
==1== by 0x4A227D4: bfd_alloc (in /usr/lib/
==1== by 0x4A22CED: bfd_zalloc (in /usr/lib/
==1== by 0x4A41DE9: _bfd_elf_
==1== by 0x4A2485E: ??? (in /usr/lib/
==1== by 0x4A40CEB: _bfd_elf_
==1== by 0x4A401DE: bfd_section_
==1== by 0x4A3BD4F: bfd_elf64_object_p (in /usr/lib/
==1== by 0x4A1AB01: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1==
==1== Invalid read of size 4
==1== at 0x4A3FFA4: bfd_section_
==1== by 0x4A4036B: bfd_section_
==1== by 0x4A4036B: bfd_section_
==1== by 0x4A4036B: bfd_section_
==1== by 0x4A3BD4F: bfd_elf64_object_p (in /usr/lib/
==1== by 0x4A1AB01: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1== by 0x111B3C: ??? (in /usr/bin/
==1== by 0x4B360B2: (below main) (libc-start.c:308)
==1== Address 0x4d469fc is 1,948 bytes inside a block of size 4,064 free'd
==1== at 0x483CA3F: free (in /usr/lib/
==1== by 0x4ABC85B: objalloc_free_block (in /usr/lib/
==1== by 0x4A1AABF: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1== by 0x111B3C: ??? (in /usr/bin/
==1== by 0x4B360B2: (below main) (libc-start.c:308)
==1== Block was alloc'd at
==1== at 0x483B7F3: malloc (in /usr/lib/
==1== by 0x4ABC65B: _objalloc_alloc (in /usr/lib/
==1== by 0x4A227D4: bfd_alloc (in /usr/lib/
==1== by 0x4A22CED: bfd_zalloc (in /usr/lib/
==1== by 0x4A41DE9: _bfd_elf_
==1== by 0x4A2485E: ??? (in /usr/lib/
==1== by 0x4A40CEB: _bfd_elf_
==1== by 0x4A401DE: bfd_section_
==1== by 0x4A3BD4F: bfd_elf64_object_p (in /usr/lib/
==1== by 0x4A1AB01: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1==
==1== Invalid write of size 4
==1== at 0x4A3FFAE: bfd_section_
==1== by 0x4A4036B: bfd_section_
==1== by 0x4A4036B: bfd_section_
==1== by 0x4A4036B: bfd_section_
==1== by 0x4A3BD4F: bfd_elf64_object_p (in /usr/lib/
==1== by 0x4A1AB01: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1== by 0x111B3C: ??? (in /usr/bin/
==1== by 0x4B360B2: (below main) (libc-start.c:308)
==1== Address 0x4d469fc is 1,948 bytes inside a block of size 4,064 free'd
==1== at 0x483CA3F: free (in /usr/lib/
==1== by 0x4ABC85B: objalloc_free_block (in /usr/lib/
==1== by 0x4A1AABF: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1== by 0x111B3C: ??? (in /usr/bin/
==1== by 0x4B360B2: (below main) (libc-start.c:308)
==1== Block was alloc'd at
==1== at 0x483B7F3: malloc (in /usr/lib/
==1== by 0x4ABC65B: _objalloc_alloc (in /usr/lib/
==1== by 0x4A227D4: bfd_alloc (in /usr/lib/
==1== by 0x4A22CED: bfd_zalloc (in /usr/lib/
==1== by 0x4A41DE9: _bfd_elf_
==1== by 0x4A2485E: ??? (in /usr/lib/
==1== by 0x4A40CEB: _bfd_elf_
==1== by 0x4A401DE: bfd_section_
==1== by 0x4A3BD4F: bfd_elf64_object_p (in /usr/lib/
==1== by 0x4A1AB01: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1==
==1== Invalid write of size 4
==1== at 0x4A40248: bfd_section_
==1== by 0x4A4036B: bfd_section_
==1== by 0x4A4036B: bfd_section_
==1== by 0x4A4036B: bfd_section_
==1== by 0x4A3BD4F: bfd_elf64_object_p (in /usr/lib/
==1== by 0x4A1AB01: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1== by 0x111B3C: ??? (in /usr/bin/
==1== by 0x4B360B2: (below main) (libc-start.c:308)
==1== Address 0x4d469fc is 1,948 bytes inside a block of size 4,064 free'd
==1== at 0x483CA3F: free (in /usr/lib/
==1== by 0x4ABC85B: objalloc_free_block (in /usr/lib/
==1== by 0x4A1AABF: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1== by 0x111B3C: ??? (in /usr/bin/
==1== by 0x4B360B2: (below main) (libc-start.c:308)
==1== Block was alloc'd at
==1== at 0x483B7F3: malloc (in /usr/lib/
==1== by 0x4ABC65B: _objalloc_alloc (in /usr/lib/
==1== by 0x4A227D4: bfd_alloc (in /usr/lib/
==1== by 0x4A22CED: bfd_zalloc (in /usr/lib/
==1== by 0x4A41DE9: _bfd_elf_
==1== by 0x4A2485E: ??? (in /usr/lib/
==1== by 0x4A40CEB: _bfd_elf_
==1== by 0x4A401DE: bfd_section_
==1== by 0x4A3BD4F: bfd_elf64_object_p (in /usr/lib/
==1== by 0x4A1AB01: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1==
objdump: /testcase: warning: loop in section dependencies detected
==1== Invalid write of size 4
==1== at 0x4A40248: bfd_section_
==1== by 0x4A4036B: bfd_section_
==1== by 0x4A4036B: bfd_section_
==1== by 0x4A3BD4F: bfd_elf64_object_p (in /usr/lib/
==1== by 0x4A1AB01: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1== by 0x111B3C: ??? (in /usr/bin/
==1== by 0x4B360B2: (below main) (libc-start.c:308)
==1== Address 0x4d46a04 is 1,956 bytes inside a block of size 4,064 free'd
==1== at 0x483CA3F: free (in /usr/lib/
==1== by 0x4ABC85B: objalloc_free_block (in /usr/lib/
==1== by 0x4A1AABF: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1== by 0x111B3C: ??? (in /usr/bin/
==1== by 0x4B360B2: (below main) (libc-start.c:308)
==1== Block was alloc'd at
==1== at 0x483B7F3: malloc (in /usr/lib/
==1== by 0x4ABC65B: _objalloc_alloc (in /usr/lib/
==1== by 0x4A227D4: bfd_alloc (in /usr/lib/
==1== by 0x4A22CED: bfd_zalloc (in /usr/lib/
==1== by 0x4A41DE9: _bfd_elf_
==1== by 0x4A2485E: ??? (in /usr/lib/
==1== by 0x4A40CEB: _bfd_elf_
==1== by 0x4A401DE: bfd_section_
==1== by 0x4A3BD4F: bfd_elf64_object_p (in /usr/lib/
==1== by 0x4A1AB01: bfd_check_
==1== by 0x116402: ??? (in /usr/bin/
==1== by 0x116532: ??? (in /usr/bin/
==1==
objdump: /testcase: file format not recognized
==1==
==1== HEAP SUMMARY:
==1== in use at exit: 0 bytes in 0 blocks
==1== total heap usage: 29 allocs, 29 frees, 178,276 bytes allocated
==1==
==1== All heap blocks were freed -- no leaks are possible
==1==
==1== For lists of detected and suppressed errors, rerun with: -s
==1== ERROR SUMMARY: 29 errors from 8 contexts (suppressed: 0 from 0)
| information type: | Private Security → Public Security |
| affects: | poppler (Ubuntu) → binutils (Ubuntu) |
| description: | updated |
| description: | updated |
| Marc Deslauriers (mdeslaur) wrote | #1 |
| Changed in binutils (Ubuntu): | |
| status: | New → Incomplete |
| Nils (nils-bars) wrote | #2 |
| Nils (nils-bars) wrote | #3 |
| Launchpad Janitor (janitor) wrote | #4 |
| Changed in binutils (Ubuntu): | |
| status: | Incomplete → Expired |
Thanks for reporting this. I don't see that attached reproducer. Could you please attach it again?