bugDatabase-driven manual pager suite - Bugs: bug #45854, Use-after-free in function...

 
 

bug #45854: Use-after-free in function ult_src()

Submitted by:  None
Submitted on:  Tue Sep 1 11:46:50 2015  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Colin Watson <cjwatson>
Open/Closed: Closed

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed Sep 9 14:55:43 2015, comment #2:

Thanks for this report. I've committed a fix:

http://git.savannah.gnu.org/cgit/man-db.git/commit/?id=c0dbcfa0191f583815cd9df7edee258c04b207f5

Feel free to apply for a CVE if you think it warrants it; I'm not sure how exploitable this category of bug tends to be.

Colin Watson <cjwatson>
Project AdministratorIn charge of this item.
Tue Sep 1 11:51:32 2015, comment #1:

Just FYI, this bug came from me, I created it without being logged in.

Hanno Boeck <hanno>
Tue Sep 1 11:46:50 2015, original submission:

The mandb tool will generate use-after-free errors in certain situations in the function ult_src().
It can be tested by having a broken man file structure where one file links to another and that links to a nonexistent file. Place attached files a.1 and b.1 into /usr/share/man/man1/ and run
mandb -f /usr/share/man/man1/a.1

Using either valgrind or address sanitizer will show the uaf error. It is happening in this code path (line 376ff):
free(base);
base = find_include (name, path, include);

I'm not exactly sure why this is happening, but it seems in certain situations name and base contain the same memory address. Therefore freeing base will cause name to be an invalid pointer, therefore causing a use-after-free.

I have attached the debugging output from both valgrind and address sanitizer.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #34783:  a.1 added by None (13B - application/octet-stream)
file #34784:  mandb-uaf-asan.txt added by None (4kB - text/plain)
file #34785:  b.1 added by None (13B - application/octet-stream)
file #34786:  mandb-uaf-valgrind.txt added by None (12kB - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by cjwatson (Posted a comment)
  • -unavailable- added by hanno (Posted a comment)
  • -unavailable- added by hanno
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed Sep 9 14:55:43 2015cjwatsonStatusNone=>Fixed
      Assigned toNone=>cjwatson
      Open/ClosedOpen=>Closed
    Tue Sep 1 11:51:32 2015hannoCarbon-Copy-=>Added hanno
    Tue Sep 1 11:46:50 2015NoneAttached File-=>Added a.1, #34783
      Attached File-=>Added mandb-uaf-asan.txt, #34784
      Attached File-=>Added b.1, #34785
      Attached File-=>Added mandb-uaf-valgrind.txt, #34786

    Back to the top


    Powered by Savane 3.1-cleanup1