Roundup: [oss-security] CVE Request: multiple bugs found in BFD libraries and Binutils' utilities

[grahamc]

Here is a report from the oss-security mailing list for Vulnerability Roundup 27.

Skip to First Email

Instructions:

Identification

Identify if we have the software, in 16.09, 17.03, and unstable. Then determine if we are vulnerable, and make a comment with your findings. It can also be helpful to specify if you think there is a patch, or if it can be fixed via a general update.

Example:

unstable: we are not vulnerable (link to the package)
17.03: we are vulnerable (link to the package)
16.09: we don't have it packaged

IMPORTANT: If you believe there are possibly related issues, bring them up on the parent issue!

Patching

Start by commenting on this issue saying you're working on a patch. This way, we don't duplicate work.

If you open a pull request, tag this issue and the master issue for the roundup.

If you commit the patch directly to a branch, please leave a comment on this issue with the branch and the commit hash, example:

fixed:

release-16.09: abc123

Skip to First Email

Upon Completion ...

• [ ] Update Graham's database

Info

Triage Indicator:

-needs-triage +roundup27 thread:00000000000041f3

• File Search: https://search.nix.gsc.io/?q=bfd&i=fosho&repos=nixos-nixpkgs
• GitHub Search: https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=bfd+in%3Apath&type=Code

Should the search term be changed from bfd? Suggest a new package search by commenting:

-suggested:bfd +suggested:correctPackageName thread:00000000000041f3

Known CVEs:

---

Skip to End

Fri, 17 Mar 2017 00:58:05 +0800 Thuan Pham <thuanpv-at-comp.nus.edu.sg>, CAMNd5sthm7v3xxeZvpd6WBXQoM8OJsst+AWK9jQinzkM-VbZiw@mail.gmail.com

Dear all,

Using AFLGo, a directed version of AFL/AFLFast fuzzing tool, we found
several bugs in the Binutils' utilities such as readelf, objdump, nm and
the BFD library (DWARF and STABS parsers).

Binary File Descriptor (BFD) library is a GNU library to manipulate object
files of many processor architecture (>=25) in a variety of formats (>=50).
The library is used by several widely-used tools like GNU Assembler (GAS),
GNU Linker (GLD), GNU Binary Utilities ("binutils") tools, and the GNU
Debugger (GDB). Binutils' utilities like readelf, objdump and nm are common
tools to analyze program objects..

Here is the list of bug reports & bug fixes. All of them have been
confirmed and fixed by Binutils' maintainers.

1) Heap Buffer Overflow - Invalid Write in Readelf
https://sourceware.org/bugzilla/show_bug.cgi?id=21137
https://sourceware.org/bugzilla/show_bug.cgi?id=21155 (bug still exists
because of incomplete fix in PR Binutils/21137)

2) Heap Buffer Overflow - Invalid Read in BFD library's DWARF
https://sourceware.org/bugzilla/show_bug.cgi?id=21151

3) Heap Buffer Overflow - Invalid Read in BFD library's handling of STABS
debug information causing Objdump to crash
https://sourceware.org/bugzilla/show_bug.cgi?id=21157

4) Global Buffer Overflow - Invalid Read in BFD library's handling of STABS
debug information
https://sourceware.org/bugzilla/show_bug.cgi?id=21158

5) Use after free in Readelf
https://sourceware.org/bugzilla/show_bug.cgi?id=21139

6) Heap buffer overflow - invalid read of size 4 in Readelf
https://sourceware.org/bugzilla/show_bug.cgi?id=21156

7) Heap buffer overflow in Readelf (Invalid Read of size 1)
https://sourceware.org/bugzilla/show_bug.cgi?id=21135
https://sourceware.org/bugzilla/show_bug.cgi?id=21159 (bug still exists due
to incomplete fix in PR Binutils/21135)

8) Heap buffer overflow in Readelf (Invalid Read of size 1)
https://sourceware.org/bugzilla/show_bug.cgi?id=21147

9) Heap buffer overflow in Readelf (Multiple Invalid Read of size 1)
https://sourceware.org/bugzilla/show_bug.cgi?id=21148

10) Heap buffer overflow in Readelf (Multiple Invalid Read of size 1)
https://sourceware.org/bugzilla/show_bug.cgi?id=21149

11) Global buffer overflow in Nm (Invalid Read of size 1)
https://sourceware.org/bugzilla/show_bug.cgi?id=21150

Could you please check whether these bugs are suitable for CVEs?
Many thanks,

----------------------------
Thuan Pham
TSUNAMi Security Research Center
National University of Singapore

Skip to End

---

Thu, 16 Mar 2017 21:15:28 +0100 Agostino Sarubbo <ago-at-gentoo.org>, 3025119.tSIlaHEIMQ@arcadia

On Friday 17 March 2017 00:58:05 Thuan Pham wrote:
> Could you please check whether these bugs are suitable for CVEs?

Thuan,
thanks for sharing.

Since few time the cve requests happens on https://cveform.mitre.org instead 
of here.

From some time of fuzz experience, from multiple cve requests and multiple 
feedback from mitre I'd say:
- In any way you are able to crash a library, it needs a cve because it is 
supposed to receive multiple inputs.
- Undefined behavior in a library also needs a cve. 
- while the bug is in a command line tool:
1) if it is a simple crash like fpe / segv, it is considered just an 
inconvenience.
2) if it is an overflow with read of size 1 is also considered an inconveniece 
unless you can demostrate any evidence of damage.
The mentioned cases are not just an inconvenience unless there are common 
cases where you know that for example a webapp relies on this command line 
tool.
3) if it is an overflow with write access it should have a cve.


@everyone, if you think it is wrong or I missed something feel free to correct 
me. 
 
-- 
Agostino Sarubbo
Gentoo Linux Developer

Skip to End

---

Fri, 17 Mar 2017 12:56:55 +0800 Thuan Pham <thuanpv-at-comp.nus.edu.sg>, CAMNd5sse8gHbyjf+eAx+1hQgf6d1VQH0vDQRy3f_YxKtA6noEw@mail.gmail.com

Dear Agostino,
Thank you very much for your prompt reply. I will choose the suitable bugs
based on your advice and submit to MITRE directly.
Many thanks,
Thuan

On Fri, Mar 17, 2017 at 4:15 AM, Agostino Sarubbo <[email protected]> wrote:

> On Friday 17 March 2017 00:58:05 Thuan Pham wrote:
> > Could you please check whether these bugs are suitable for CVEs?
>
> Thuan,
> thanks for sharing.
>
> Since few time the cve requests happens on https://cveform.mitre.org
> instead
> of here.
>
> From some time of fuzz experience, from multiple cve requests and multiple
> feedback from mitre I'd say:
> - In any way you are able to crash a library, it needs a cve because it is
> supposed to receive multiple inputs.
> - Undefined behavior in a library also needs a cve.
> - while the bug is in a command line tool:
> 1) if it is a simple crash like fpe / segv, it is considered just an
> inconvenience.
> 2) if it is an overflow with read of size 1 is also considered an
> inconveniece
> unless you can demostrate any evidence of damage.
> The mentioned cases are not just an inconvenience unless there are common
> cases where you know that for example a webapp relies on this command line
> tool.
> 3) if it is an overflow with write access it should have a cve.
>
>
> @everyone, if you think it is wrong or I missed something feel free to
> correct
> me.
>
> --
> Agostino Sarubbo
> Gentoo Linux Developer
>

Skip to End

---