bugDatabase-driven manual pager suite - Bugs: bug #45854, Use-after-free in function...

 
 

bug #45854: Use-after-free in function ult_src()

Submitter:  None
Submitted:  Tue 01 Sep 2015 11:46:50 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  cjwatson
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 09 Sep 2015 02:55:43 PM UTC, comment #2: 

Thanks for this report.  I've committed a fix:

  http://git.savannah.gnu.org/cgit/man-db.git/commit/?id=c0dbcfa0191f583815cd9df7edee258c04b207f5

Feel free to apply for a CVE if you think it warrants it; I'm not sure how exploitable this category of bug tends to be.

Colin Watson <cjwatson>
Group administrator
Tue 01 Sep 2015 11:51:32 AM UTC, comment #1: 

Just FYI, this bug came from me, I created it without being logged in.

Hanno Boeck <hanno>
Tue 01 Sep 2015 11:46:50 AM UTC, original submission:  

The mandb tool will generate use-after-free errors in certain situations in the function ult_src().
It can be tested by having a broken man file structure where one file links to another and that links to a nonexistent file. Place attached files a.1 and b.1 into /usr/share/man/man1/ and run
mandb -f /usr/share/man/man1/a.1

Using either valgrind or address sanitizer will show the uaf error. It is happening in this code path (line 376ff):
free(base);
base = find_include (name, path, include);

I'm not exactly sure why this is happening, but it seems in certain situations name and base contain the same memory address. Therefore freeing base will cause name to be an invalid pointer, therefore causing a use-after-free.

I have attached the debugging output from both valgrind and address sanitizer.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #34783:  a.1 added by None (13B - application/octet-stream)
file #34784:  mandb-uaf-asan.txt added by None (4KiB - text/plain)
file #34785:  b.1 added by None (13B - application/octet-stream)
file #34786:  mandb-uaf-valgrind.txt added by None (12KiB - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by cjwatson (Posted a comment)
  • -email is unavailable- added by hanno (Posted a comment)
  • -email is unavailable- added by hanno
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-09-09 cjwatson StatusNone Fixed
        Assigned toNone cjwatson
        Open/ClosedOpen Closed
    2015-09-01 hanno Carbon-Copy- Added hanno
    2015-09-01 None Attached File- Added a.1, #34783
        Attached File- Added mandb-uaf-asan.txt, #34784
        Attached File- Added b.1, #34785
        Attached File- Added mandb-uaf-valgrind.txt, #34786

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code