Bug 15841 - busybox - Memory leaks in TAR
Summary: busybox - Memory leaks in TAR
Status: NEW
Alias: None
Product: Busybox
Classification: Unclassified
Component: Other (show other bugs)
Version: unspecified
Hardware: PC Linux
: P5 major
Target Milestone: ---
Assignee: unassigned
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-11-04 08:15 UTC by Carlos Andres Ramirez Catano
Modified: 2023-11-04 08:15 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:

Attachments
Busybox Memory Leaks (512 bytes, application/x-tar)
2023-11-04 08:15 UTC, Carlos Andres Ramirez Catano 		Details
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos Andres Ramirez Catano 2023-11-04 08:15:07 UTC 
Created attachment 9652 [details]
Busybox Memory Leaks

A memory corruption issue exists in BusyBox through version v1.37 in which malcrafted tar file headers trigger a left shift operation of negative value at getOctal() in get_header_tar.c.

As a result, and depending on the input, memory leaks and/or crashes occur.

VALGRIND OUTPUT
  valgrind --leak-check=full ./busybox tar -xvf input.tar -O
  ...
  ==926823== 256 (184 direct, 72 indirect) bytes in 1 blocks are definitely lost in loss record 2 of 2
  ==926823==    at 0x48407B4: malloc (vg_replace_malloc.c:381)
  ==926823==    by 0x1196F2: xmalloc (in /home/andres/misc/framework/repos/busybox.old/busybox.full)
  ==926823==    by 0xB7: ???
  ==926823==    by 0x119726: xzalloc (in /home/andres/misc/framework/repos/busybox.old/busybox.full)
  ==926823== 

ASAN OUPUT
archival/libarchive/get_header_tar.c:58:9: runtime error: left shift of negative value -1
=================================================================
==2240392==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 184 byte(s) in 1 object(s) allocated from:
    #0 0x7ffff78d85bf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x555555c103e3  (/home/andres/misc/framework/repos/busybox/busybox+0x6bc3e3) (BuildId: a68871b52750d3e6001195b071395ec9ad84ec1f)

Indirect leak of 72 byte(s) in 1 object(s) allocated from:
    #0 0x7ffff78d85bf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x555555c103e3  (/home/andres/misc/framework/repos/busybox/busybox+0x6bc3e3) (BuildId: a68871b52750d3e6001195b071395ec9ad84ec1f)

SUMMARY: AddressSanitizer: 256 byte(s) leaked in 2 allocation(s).

IMPACT: Availability is impacted.
Further exploitation has not been confirmed.

PoC [See attached file]

https://github.com/CarlosAndresRamirez/PoCs/blob/main/busybox-v1.37_2023-11-04/busybox-tar-PoC-01.tar


---
Carlos Andres Ramirez
Security Engineer
https://carlos.engineer/