Hello,
I found a memory-safety issue in elfutils (libdw) by static source review
and am
reporting it for coordinated disclosure before any public record, so you
hear about
it from me first.
Component : libdw/dwarf_getlocation.c, getlocations_addr and
__libdw_intern_expression.
A 64-bit location-expression length in .debug_loclists defeats
a signed
bounds check and causes an out-of-bounds read.
Class : CWE-125 Out-of-bounds Read.
Affected : release 0.196 (latest), reviewed through the Debian source
package 0.196-1.
Write-up :
https://hackmd.io/@haindpwn/elfutils-loclists-expr-length-oob-read
Confirmed by static source review against the released source; not run
against a live
deployment. If you prefer a Bugzilla entry or a private channel, tell me
and I will use it.
Hello,
I found a memory-safety issue in elfutils (libdw) by static source review
and am
reporting it for coordinated disclosure before any public record, so you
hear about
it from me first.
Component : libdw/dwarf_getlocation.c, getlocations_addr and
__libdw_intern_expression.
A 64-bit location-expression length in .debug_loclists defeats
a signed
bounds check and causes an out-of-bounds read.
Class : CWE-125 Out-of-bounds Read.
Affected : release 0.196 (latest), reviewed through the Debian source
package 0.196-1.
Write-up :
https://hackmd.io/@haindpwn/elfutils-loclists-expr-length-oob-read
Confirmed by static source review against the released source; not run
against a live
deployment. If you prefer a Bugzilla entry or a private channel, tell me
and I will use it.
Thank you,
HaiND (Nguyen Dinh Hai), Post and Telecommunication Institute of Technology
[email protected]
https://github.com/Haind03
