| Summary: | CVE-2021-42380 unrepaired or new issues introduced by fixing CVE-2021-42380. | ||
|---|---|---|---|
| Product: | Busybox | Reporter: | Taolaw <magicgoogol> |
| Component: | Standard Compliance | Assignee: | unassigned |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | busybox-cvs |
| Priority: | P5 | ||
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Host: | Target: | ||
| Build: | |||
| Attachments: | poc | ||
Excellent example! Thank you. Fixed in git. |
Created attachment 9601 [details] poc Discoverer: Taolaw@Vlab of Vecentek $ ./busybox_unstripped awk -f '/home/fuzz/vuln_search/poc/CVE-2021-42380' '/home/fuzz/vuln_search/poc/1.txt' ─ process timing ────────────────────────────────────┬─ ─ process timing ──────────────────── results ────┐──┬─ overall results ────┐ days, 0 hrs, 0 min, 56 sec │ cycles done : 0 │ 0 min, 56 sec │ cycles done : 0 │ │ last new find │ last new find : 0 days, 0 hrs, 0 min, 1 sec │ corpus count : 208 0 days, 0 hrs, 0 min, 1 sec │ corpus count : 208 │ │last saved crash : │last saved crash : none seen yet │saved crashes : 0 seen yet │saved crashes : 0 │ │ last saved hang │ last saved hang : none seen yet │ saved hangs : 0 none seen yet │ saved hangs : 0 │ ├─ cycle progress ─────────────────────┬─ ├─ cycle progress ─────────────────────┬─ map cover coverage┴──────────────────────┤ ================================================================= ==474939==ERROR: AddressSanitizer: heap-use-after-free on address 0x619000000b00 at pc 0x558ba8a13137 bp 0x7ffcfb7b8990 sp 0x7ffcfb7b8980 READ of size 4 at 0x619000000b00 thread T0 #0 0x558ba8a13136 in clrvar (/home/fuzz/vuln_search/busybox/busybox-1.36.1/busybox_unstripped+0x9c8136) 0x619000000b00 is located 128 bytes inside of 1088-byte region [0x619000000a80,0x619000000ec0) freed by thread T0 here: #0 0x7f1e23748c3e in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:163 #1 0x558ba87009dc in xrealloc (/home/fuzz/vuln_search/busybox/busybox-1.36.1/busybox_unstripped+0x6b59dc) previously allocated by thread T0 here: #0 0x7f1e23748c3e in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:163 #1 0x558ba87009dc in xrealloc (/home/fuzz/vuln_search/busybox/busybox-1.36.1/busybox_unstripped+0x6b59dc) SUMMARY: AddressSanitizer: heap-use-after-free (/home/fuzz/vuln_search/busybox/busybox-1.36.1/busybox_unstripped+0x9c8136) in clrvar Shadow bytes around the buggy address: 0x0c327fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c327fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c327fff8130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c327fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c327fff8150: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c327fff8160:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c327fff8170: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c327fff8180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c327fff8190: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c327fff81a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c327fff81b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==474939==ABORTING