New submission from BeginVuln: OS Version : Ubuntu 16.04 LTS Python download link : https://www.python.org/ftp/python/3.6.0/Python-3.6.0.tar.xz
Python version : 3.6.0 Normal build cmd : ./configure make Asan build cmd: export CC="/usr/bin/clang -fsanitize=address export CXX="/usr/bin/clang++ -fsanitize=address ./confiugre make GDB with exploitable: To enable execution of this file add add-auto-load-safe-path /home/test/check/PythonGDB/python-gdb.py line to your configuration file "/home/test/.gdbinit". To completely disable this security protection add set auto-load safe-path / line to your configuration file "/home/test/.gdbinit". For more information about this security protection see the "Auto-loading safe path" section in the GDB manual. E.g., run from the shell: info "(gdb)Auto-loading safe path" [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Program received signal SIGABRT, Aborted. 0x00007ffff7116418 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54 Description: Heap error Short description: HeapError (10/22) Hash: 2aa3ac417e1aa62c7fe1524ebca9f7a3.8d7f0ad1f2db61942ed3977c83757030 Exploitability Classification: EXPLOITABLE Explanation: The target's backtrace indicates that libc has detected a heap error or that the target was executing a heap function when it stopped. This could be due to heap corruption, passing a bad pointer to a heap function such as free(), etc. Since heap errors might include buffer overflows, use-after-free situations, etc. they are generally considered exploitable. Other tags: AbortSignal (20/22) ASAN: ASAN:DEADLYSIGNAL ================================================================= ==18277==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x7f65f421d380 bp 0x7f65f4560b20 sp 0x7ffe10375320 T0) #0 0x7f65f421d37f in _int_free /build/glibc-GKVZIf/glibc-2.23/malloc/malloc.c:4057 #1 0x7f65f421d37f in ?? ??:0 #2 0x7f65f4220abb in __GI___libc_free /build/glibc-GKVZIf/glibc-2.23/malloc/malloc.c:2969 (discriminator 4) #3 0x7f65f4220abb in ?? ??:0 #4 0x7f65f0640e3f in ffi_call_unix64 ??:? #5 0x7f65f0640e3f in ?? ??:0 #6 0x7f65f06408aa in ffi_call ??:? #7 0x7f65f06408aa in ?? ??:0 #8 0x7f65f0885311 in _call_function_pointer /home/test/check/PythonASAN/Modules/_ctypes/callproc.c:809 #9 0x7f65f0885311 in _ctypes_callproc /home/test/check/PythonASAN/Modules/_ctypes/callproc.c:1147 #10 0x7f65f0885311 in ?? ??:0 #11 0x7f65f0874199 in PyCFuncPtr_call /home/test/check/PythonASAN/Modules/_ctypes/_ctypes.c:3870 #12 0x7f65f0874199 in ?? ??:0 #13 0x5745f0 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2316 #14 0x5745f0 in ?? ??:0 #15 0x7a7429 in call_function /home/test/check/PythonASAN/Python/ceval.c:4812 #16 0x7a7429 in ?? ??:0 #17 0x7995cc in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3275 #18 0x7995cc in ?? ??:0 #19 0x7ab4cb in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718 #20 0x7ab4cb in _PyFunction_FastCall /home/test/check/PythonASAN/Python/ceval.c:4870 #21 0x7ab4cb in fast_function /home/test/check/PythonASAN/Python/ceval.c:4905 #22 0x7ab4cb in ?? ??:0 #23 0x7a76f2 in call_function /home/test/check/PythonASAN/Python/ceval.c:4809 #24 0x7a76f2 in ?? ??:0 #25 0x7995cc in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3275 #26 0x7995cc in ?? ??:0 #27 0x7a9847 in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718 #28 0x7a9847 in _PyEval_EvalCodeWithName /home/test/check/PythonASAN/Python/ceval.c:4119 #29 0x7a9847 in ?? ??:0 #30 0x7ac2ea in _PyFunction_FastCallDict /home/test/check/PythonASAN/Python/ceval.c:5021 #31 0x7ac2ea in ?? ??:0 #32 0x574668 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2295 #33 0x574668 in ?? ??:0 #34 0x5749fa in _PyObject_Call_Prepend /home/test/check/PythonASAN/Objects/abstract.c:2358 #35 0x5749fa in ?? ??:0 #36 0x573e9b in PyObject_Call /home/test/check/PythonASAN/Objects/abstract.c:2246 #37 0x573e9b in ?? ??:0 #38 0x793369 in do_call_core /home/test/check/PythonASAN/Python/ceval.c:5057 #39 0x793369 in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3357 #40 0x793369 in ?? ??:0 #41 0x7a9847 in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718 #42 0x7a9847 in _PyEval_EvalCodeWithName /home/test/check/PythonASAN/Python/ceval.c:4119 #43 0x7a9847 in ?? ??:0 #44 0x7ac2ea in _PyFunction_FastCallDict /home/test/check/PythonASAN/Python/ceval.c:5021 #45 0x7ac2ea in ?? ??:0 #46 0x574668 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2295 #47 0x574668 in ?? ??:0 #48 0x5749fa in _PyObject_Call_Prepend /home/test/check/PythonASAN/Objects/abstract.c:2358 #49 0x5749fa in ?? ??:0 #50 0x573e9b in PyObject_Call /home/test/check/PythonASAN/Objects/abstract.c:2246 #51 0x573e9b in ?? ??:0 #52 0x66efe4 in slot_tp_call /home/test/check/PythonASAN/Objects/typeobject.c:6167 #53 0x66efe4 in ?? ??:0 #54 0x5745f0 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2316 #55 0x5745f0 in ?? ??:0 #56 0x7a7429 in call_function /home/test/check/PythonASAN/Python/ceval.c:4812 #57 0x7a7429 in ?? ??:0 #58 0x7995cc in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3275 #59 0x7995cc in ?? ??:0 #60 0x7a9847 in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718 #61 0x7a9847 in _PyEval_EvalCodeWithName /home/test/check/PythonASAN/Python/ceval.c:4119 #62 0x7a9847 in ?? ??:0 #63 0x7ac2ea in _PyFunction_FastCallDict /home/test/check/PythonASAN/Python/ceval.c:5021 #64 0x7ac2ea in ?? ??:0 #65 0x574668 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2295 #66 0x574668 in ?? ??:0 #67 0x5749fa in _PyObject_Call_Prepend /home/test/check/PythonASAN/Objects/abstract.c:2358 #68 0x5749fa in ?? ??:0 #69 0x573e9b in PyObject_Call /home/test/check/PythonASAN/Objects/abstract.c:2246 #70 0x573e9b in ?? ??:0 #71 0x793369 in do_call_core /home/test/check/PythonASAN/Python/ceval.c:5057 #72 0x793369 in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3357 #73 0x793369 in ?? ??:0 #74 0x7a9847 in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718 #75 0x7a9847 in _PyEval_EvalCodeWithName /home/test/check/PythonASAN/Python/ceval.c:4119 #76 0x7a9847 in ?? ??:0 #77 0x7ac2ea in _PyFunction_FastCallDict /home/test/check/PythonASAN/Python/ceval.c:5021 #78 0x7ac2ea in ?? ??:0 #79 0x574668 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2295 #80 0x574668 in ?? ??:0 #81 0x5749fa in _PyObject_Call_Prepend /home/test/check/PythonASAN/Objects/abstract.c:2358 #82 0x5749fa in ?? ??:0 #83 0x573e9b in PyObject_Call /home/test/check/PythonASAN/Objects/abstract.c:2246 #84 0x573e9b in ?? ??:0 #85 0x66efe4 in slot_tp_call /home/test/check/PythonASAN/Objects/typeobject.c:6167 #86 0x66efe4 in ?? ??:0 #87 0x5745f0 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2316 #88 0x5745f0 in ?? ??:0 #89 0x7a7429 in call_function /home/test/check/PythonASAN/Python/ceval.c:4812 #90 0x7a7429 in ?? ??:0 #91 0x7995cc in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3275 #92 0x7995cc in ?? ??:0 #93 0x7a9847 in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718 #94 0x7a9847 in _PyEval_EvalCodeWithName /home/test/check/PythonASAN/Python/ceval.c:4119 #95 0x7a9847 in ?? ??:0 #96 0x7ac2ea in _PyFunction_FastCallDict /home/test/check/PythonASAN/Python/ceval.c:5021 #97 0x7ac2ea in ?? ??:0 #98 0x574668 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2295 #99 0x574668 in ?? ??:0 #100 0x5749fa in _PyObject_Call_Prepend /home/test/check/PythonASAN/Objects/abstract.c:2358 #101 0x5749fa in ?? ??:0 #102 0x573e9b in PyObject_Call /home/test/check/PythonASAN/Objects/abstract.c:2246 #103 0x573e9b in ?? ??:0 #104 0x793369 in do_call_core /home/test/check/PythonASAN/Python/ceval.c:5057 #105 0x793369 in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3357 #106 0x793369 in ?? ??:0 #107 0x7a9847 in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718 #108 0x7a9847 in _PyEval_EvalCodeWithName /home/test/check/PythonASAN/Python/ceval.c:4119 #109 0x7a9847 in ?? ??:0 #110 0x7ac2ea in _PyFunction_FastCallDict /home/test/check/PythonASAN/Python/ceval.c:5021 #111 0x7ac2ea in ?? ??:0 #112 0x574668 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2295 #113 0x574668 in ?? ??:0 #114 0x5749fa in _PyObject_Call_Prepend /home/test/check/PythonASAN/Objects/abstract.c:2358 #115 0x5749fa in ?? ??:0 #116 0x573e9b in PyObject_Call /home/test/check/PythonASAN/Objects/abstract.c:2246 #117 0x573e9b in ?? ??:0 #118 0x66efe4 in slot_tp_call /home/test/check/PythonASAN/Objects/typeobject.c:6167 #119 0x66efe4 in ?? ??:0 #120 0x5745f0 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2316 #121 0x5745f0 in ?? ??:0 #122 0x7a7429 in call_function /home/test/check/PythonASAN/Python/ceval.c:4812 #123 0x7a7429 in ?? ??:0 #124 0x7995cc in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3275 #125 0x7995cc in ?? ??:0 #126 0x7ab4cb in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718 #127 0x7ab4cb in _PyFunction_FastCall /home/test/check/PythonASAN/Python/ceval.c:4870 #128 0x7ab4cb in fast_function /home/test/check/PythonASAN/Python/ceval.c:4905 #129 0x7ab4cb in ?? ??:0 #130 0x7a76f2 in call_function /home/test/check/PythonASAN/Python/ceval.c:4809 #131 0x7a76f2 in ?? ??:0 #132 0x7995cc in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3275 #133 0x7995cc in ?? ??:0 #134 0x7ab4cb in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718 #135 0x7ab4cb in _PyFunction_FastCall /home/test/check/PythonASAN/Python/ceval.c:4870 #136 0x7ab4cb in fast_function /home/test/check/PythonASAN/Python/ceval.c:4905 #137 0x7ab4cb in ?? ??:0 #138 0x7a76f2 in call_function /home/test/check/PythonASAN/Python/ceval.c:4809 #139 0x7a76f2 in ?? ??:0 #140 0x7995cc in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3275 #141 0x7995cc in ?? ??:0 #142 0x7a9847 in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718 #143 0x7a9847 in _PyEval_EvalCodeWithName /home/test/check/PythonASAN/Python/ceval.c:4119 #144 0x7a9847 in ?? ??:0 #145 0x7ac2ea in _PyFunction_FastCallDict /home/test/check/PythonASAN/Python/ceval.c:5021 #146 0x7ac2ea in ?? ??:0 #147 0x574668 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2295 #148 0x574668 in ?? ??:0 #149 0x5749fa in _PyObject_Call_Prepend /home/test/check/PythonASAN/Objects/abstract.c:2358 #150 0x5749fa in ?? ??:0 #151 0x573e9b in PyObject_Call /home/test/check/PythonASAN/Objects/abstract.c:2246 #152 0x573e9b in ?? ??:0 #153 0x6713f8 in slot_tp_init /home/test/check/PythonASAN/Objects/typeobject.c:6380 #154 0x6713f8 in ?? ??:0 #155 0x666d8d in type_call /home/test/check/PythonASAN/Objects/typeobject.c:915 (discriminator 1) #156 0x666d8d in ?? ??:0 #157 0x5745f0 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2316 #158 0x5745f0 in ?? ??:0 #159 0x7a7429 in call_function /home/test/check/PythonASAN/Python/ceval.c:4812 #160 0x7a7429 in ?? ??:0 #161 0x7995cc in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3275 #162 0x7995cc in ?? ??:0 #163 0x7a9847 in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718 #164 0x7a9847 in _PyEval_EvalCodeWithName /home/test/check/PythonASAN/Python/ceval.c:4119 #165 0x7a9847 in ?? ??:0 #166 0x78e0df in PyEval_EvalCodeEx /home/test/check/PythonASAN/Python/ceval.c:4140 #167 0x78e0df in PyEval_EvalCode /home/test/check/PythonASAN/Python/ceval.c:695 #168 0x78e0df in ?? ??:0 #169 0x5142f5 in run_mod /home/test/check/PythonASAN/Python/pythonrun.c:980 #170 0x5142f5 in PyRun_FileExFlags /home/test/check/PythonASAN/Python/pythonrun.c:933 #171 0x5142f5 in ?? ??:0 #172 0x512afa in PyRun_SimpleFileExFlags /home/test/check/PythonASAN/Python/pythonrun.c:396 #173 0x512afa in ?? ??:0 #174 0x53eefd in run_file /home/test/check/PythonASAN/Modules/main.c:320 #175 0x53eefd in Py_Main /home/test/check/PythonASAN/Modules/main.c:780 #176 0x53eefd in ?? ??:0 #177 0x503d16 in main /home/test/check/PythonASAN/./Programs/python.c:69 #178 0x503d16 in ?? ??:0 #179 0x7f65f41bd82f in __libc_start_main /build/glibc-GKVZIf/glibc-2.23/csu/../csu/libc-start.c:291 #180 0x7f65f41bd82f in ?? ??:0 #181 0x432548 in _start ??:? #182 0x432548 in ?? ??:0 AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x8037f) ==18277==ABORTING ---------- components: Interpreter Core files: malloc_4057 messages: 287336 nosy: beginvuln priority: normal severity: normal status: open title: AddressSanitizer: SEGV on unknown address 0x000000000008 type: security versions: Python 3.6 Added file: http://bugs.python.org/file46592/malloc_4057 _______________________________________ Python tracker <rep...@bugs.python.org> <http://bugs.python.org/issue29497> _______________________________________ _______________________________________________ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com