oss-sec mailing list archives
libarchive: heap-based buffer overflow in xml_data (archive_read_support_format_xar.c)
From: "Agostino Sarubbo" <ago () gentoo org>
Date: Wed, 6 Sep 2017 19:02:56 +0000
Description: libarchive is a multi-format archive and compression library. The complete ASan output of the issue: # bsdtar -t -f $FILE ==13144==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000038800 at pc 0x7fb1c808f650 bp 0x7ffdd1b40990 sp 0x7ffdd1b40988 READ of size 1 at 0x631000038800 thread T0 #0 0x7fb1c808f64f in xml_data /var/tmp/portage/app-arch/libarchive-3.3.2/work/libarchive-3.3.2/libarchive/archive_read_support_format_xar.c #1 0x7fb1c808f64f in expat_data_cb /var/tmp/portage/app-arch/libarchive-3.3.2/work/libarchive-3.3.2/libarchive/archive_read_support_format_xar.c:3230 #2 0x7fb1c697c3b6 in _init /var/tmp/portage/dev-libs/expat-2.2.1/work/expat-2.2.1/lib/xmlparse.c:2960 #3 0x7fb1c697cb9b in _init /var/tmp/portage/dev-libs/expat-2.2.1/work/expat-2.2.1/lib/xmlparse.c:2418 #4 0x7fb1c697e988 in _init /var/tmp/portage/dev-libs/expat-2.2.1/work/expat-2.2.1/lib/xmlparse.c:4366 #5 0x7fb1c697f137 in _init /var/tmp/portage/dev-libs/expat-2.2.1/work/expat-2.2.1/lib/xmlparse.c:4089 #6 0x7fb1c6980fc7 in XML_ParseBuffer /var/tmp/portage/dev-libs/expat-2.2.1/work/expat-2.2.1/lib/xmlparse.c:1915 #7 0x7fb1c807d62a in expat_read_toc /var/tmp/portage/app-arch/libarchive-3.3.2/work/libarchive-3.3.2/libarchive/archive_read_support_format_xar.c:3273:8 #8 0x7fb1c807d62a in read_toc /var/tmp/portage/app-arch/libarchive-3.3.2/work/libarchive-3.3.2/libarchive/archive_read_support_format_xar.c:584 #9 0x7fb1c807d62a in xar_read_header /var/tmp/portage/app-arch/libarchive-3.3.2/work/libarchive-3.3.2/libarchive/archive_read_support_format_xar.c:677 #10 0x7fb1c7f728ed in _archive_read_next_header2 /var/tmp/portage/app-arch/libarchive-3.3.2/work/libarchive-3.3.2/libarchive/archive_read.c:648:7 #11 0x7fb1c7f72590 in _archive_read_next_header /var/tmp/portage/app-arch/libarchive-3.3.2/work/libarchive-3.3.2/libarchive/archive_read.c:686:8 #12 0x51483f in read_archive /var/tmp/portage/app-arch/libarchive-3.3.2/work/libarchive-3.3.2/tar/read.c:260:7 #13 0x513d89 in tar_mode_t /var/tmp/portage/app-arch/libarchive-3.3.2/work/libarchive-3.3.2/tar/read.c:94:2 #14 0x50eaae in main /var/tmp/portage/app-arch/libarchive-3.3.2/work/libarchive-3.3.2/tar/bsdtar.c:858:3 #15 0x7fb1c6ffe680 in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.23-r4/work/glibc-2.23/csu/../csu/libc-start.c:289 #16 0x41c628 in _init (/usr/bin/bsdtar+0x41c628) 0x631000038800 is located 0 bytes to the right of 65536-byte region [0x631000028800,0x631000038800) allocated by thread T0 here: #0 0x4d1fd8 in malloc /var/tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.1/work/compiler-rt-4.0.1.src/lib/asan/asan_malloc_linux.cc:66 #1 0x7fb1c69811f5 in XML_GetBuffer /var/tmp/portage/dev-libs/expat-2.2.1/work/expat-2.2.1/lib/xmlparse.c:2004 SUMMARY: AddressSanitizer: heap-buffer-overflow /var/tmp/portage/app-arch/libarchive-3.3.2/work/libarchive-3.3.2/libarchive/archive_read_support_format_xar.c in xml_data Shadow bytes around the buggy address: 0x0c627ffff0b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c627ffff0c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c627ffff0d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c627ffff0e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c627ffff0f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c627ffff100:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c627ffff110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c627ffff120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c627ffff130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c627ffff140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c627ffff150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==13144==ABORTING Affected version: 3.3.2 Fixed version: N/A Commit fix: https://github.com/libarchive/libarchive/commit/fa7438a0ff4033e4741c807394a9af6207940d71 Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: CVE-2017-14166 Reproducer: https://github.com/asarubbo/poc/blob/master/00316-libarchive-heapoverflow-archive_read_support_format_xar Timeline: 2017-08-15: bug discovered and reported to upstream 2017-09-05: upstream released a patch 2017-09-06: blog post about the issue 2017-09-06: CVE assigned Note: This bug was found with American Fuzzy Lop. This bug was identified with bare metal servers donated by Packet. This work is also supported by the Core Infrastructure Initiative. Permalink: https://blogs.gentoo.org/ago/2017/09/06/libarchive-heap-based-buffer-overflow-in-xml_data-archive_read_support_format_xar-c/ -- Agostino Sarubbo Gentoo Linux Developer
Current thread:
- libarchive: heap-based buffer overflow in xml_data (archive_read_support_format_xar.c) Agostino Sarubbo (Sep 06)