[Crash] Segmentation Fault in print_elf64_shdrs due to unchecked section name index
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 68/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Stale
- Tech stack
- c
- Domain
- operating-systems, security
Research direction
Start in src/pelf.c at print_elf64_shdrs, specifically line 408, and reproduce the crash with the AddressSanitizer build and modified ELF file described above. Check the section name index before it is used; done means the crafted file no longer causes a segmentation fault or out-of-bounds read under AddressSanitizer.
Written by the indexing model from the issue text.
Description
Description
The parse-elf utility crashes with a Segmentation Fault (SEGV) when parsing a specially crafted ELF file. This is caused by a missing bounds check when reading the section name index (sh_name).
Vulnerability Type
Heap-based Buffer Over-read / Denial of Service.
Steps to Reproduce
- Compile the project with AddressSanitizer:
gcc -fsanitize=address -g src/pelf.c -o parser - Open a valid ELF file in a hex editor.
- Locate the Section Header Table.
- Modify the
sh_namefield of the first section header to0xFFFFFFFF. - Run the parser:
./parser modified_elf
Crash Log (AddressSanitizer)
==1307716==ERROR: AddressSanitizer: SEGV on unknown address ...
#0 0x7ffff7936286 in __sanitizer::internal_strlen
#4 0x55555555a36e in print_elf64_shdrs src/pelf.c:408
SUMMARY: AddressSanitizer: SEGV src/pelf.c:408 in print_elf64_shdrs- Dominant language
- C
- Stars
- 7
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Similar issues
-
level/task module/gcp type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
docs
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
P3 sonic-vpp
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
sonic-net/sonic-buildimage#29662 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 94/100
spack/spack-packages#6586 ·
-
category:port-update
Difficulty 2/5 1-3 hours Newbie friendliness 72/100