https://sourceware.org/bugzilla/show_bug.cgi?id=34495
Bug ID: 34495
Summary: Use-after-free in libasm subsection filling
Product: elfutils
Version: unspecified
Status: NEW
Severity: normal
Priority: P2
Component: libasm
Assignee: unassigned at sourceware dot org
Reporter: fweimer at redhat dot com
CC: elfutils-devel at sourceware dot org
Target Milestone: ---
Created attachment 16913
--> https://sourceware.org/bugzilla/attachment.cgi?id=16913&action=edit
Flaw report
I believe the attached report is valid as a bug report. It's not a security
vulnerability because no trust boundary is crossed.
The core of the issue, as far as I can tell, is that the pattern is simply
copied here in asm_newsubscn:
/* Inherit the fill pattern from the section this one is derived from. */
newp->pattern = asmscn->pattern;
It is freed unconditionally in asm_fill:
/* Free the old data structure if we have allocated it. */
if (old_pattern != __libasm_default_pattern)
free (old_pattern);
This needs to make a copy or involve some form of reference counting, I think.
I've been instructed to mention this: Found by AISLE in partnership with Red
Hat.
--
You are receiving this mail because:
You are on the CC list for the bug.
