https://sourceware.org/bugzilla/show_bug.cgi?id=34579
Bug ID: 34579
Summary: libdwfl_stacktrace: dwflst_sample_getframes retains
caller-owned buffers after return, causing
use-after-free on re-entry
Product: elfutils
Version: unspecified
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: libdw
Assignee: unassigned at sourceware dot org
Reporter: karankurani3k at gmail dot com
CC: elfutils-devel at sourceware dot org
Target Milestone: ---
Created attachment 16971
--> https://sourceware.org/bugzilla/attachment.cgi?id=16971&action=edit
Detailed lifecycle analysis and native x86_64/AArch64 reproduction of
post-return caller-buffer use-after-free in dwflst_sample_getframes().
Current main: 64e89606ff4967a647525524aec00dd33765ba2a
dwflst_sample_getframes() stores caller-owned stack, regs and regs_mapping
pointers in sample_info, which remains attached through
dwfl->process->callbacks_arg after the function returns.
The public header explicitly requires Elf to remain valid for the Dwfl
lifetime, but specifies no equivalent lifetime requirement for these buffers.
After dwflst_sample_getframes() returns, freeing stack and then calling
dwfl_getthread_frames() again on the same Dwfl produces:
ASan heap-use-after-free
READ of size 8
sample_memory_read(), dwflst_sample_frame.c:264
Native x86_64: reproduced 3/3; buffers-kept-alive control: 3/3 clean.
AArch64 independently reproduces stale stack and regs_mapping accesses.
Current eu-stackprof use is synchronous and replaces these pointers on the
next sample, so I have not demonstrated a current eu-stackprof trigger.
Impact is a memory-safety defect causing crash/undefined behavior through
valid API sequencing. I have not demonstrated a write primitive, information
disclosure, code execution, or RCE.
Detailed lifecycle analysis and runtime validation are attached.
--
You are receiving this mail because:
You are on the CC list for the bug.
