Bug 15086

Created attachment 9391 [details]
poc

1.
Busybox bc Calculator bc_vec_npush Function Uaf Vulnerability
busybox-master\busybox\miscutils\bc.c
In line 1105，UAF Caused by the Memory Referenced by v

1102
1103 static size_t bc_vec_npush(BcVec *v, size_t n, const void *da     ta)
1104 {
1105         size_t len = v->len;
1106         if (len + n > v->cap) bc_vec_grow(v, n);
1107         memmove(v->v + (v->size * len), data, v->size * n);
1108         v->len = len + n;
1109         return len;
1110 }
1111

2 
Affected versions Busybox 1.33 to Busybox 1.35
The latest version is affected.


3 asan report

busybox_unstripped bc id:000083,sig:06,src:001758+001745,time:662304425,execs:76703360,op:splice,rep:2
bc 1.36.0.git
Adapted from https://github.com/gavinhoward/bc
Original code (c) 2018 Gavin D. Howard and contributors
1
4
49
4
4
=================================================================
==1231022==ERROR: AddressSanitizer: heap-use-after-free on address 0x623000000108 at pc 0x55b9a94ac5f9 bp 0x7ffc33fe5990 sp 0x7ffc33fe5980
READ of size 8 at 0x623000000108 thread T0
    #0 0x55b9a94ac5f8 in bc_vec_npush miscutils/bc.c:1148

0x623000000108 is located 8 bytes inside of 6912-byte region [0x623000000100,0x623000001c00)
freed by thread T0 here:
    #0 0x7f78a30a7ffe in __interceptor_realloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dffe)
    #1 0x55b9a9488f7e in xrealloc libbb/xfuncs_printf.c:61
    #2 0x55b9a9ab5d3f  (busybox-master/busybox_unstripped+0xed0d3f)

previously allocated by thread T0 here:
    #0 0x7f78a30a7bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    #1 0x55b9a9488f30 in xmalloc libbb/xfuncs_printf.c:50

SUMMARY: AddressSanitizer: heap-use-after-free miscutils/bc.c:1148 in bc_vec_npush
Shadow bytes around the buggy address:
  0x0c467fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c467fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c467fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c467fff8000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c467fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c467fff8020: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c467fff8030: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c467fff8040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c467fff8050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c467fff8060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c467fff8070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1231022==ABORTING