`unpack-pbp`: unvalidated PBP offsets → silent file clobbering and attacker-sized write; `psp-prxgen`: unbounded `strcpy` of section name

Aperta
  • Qualcosa non va?
#412 4 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
c
Ambito
security, tooling

Direzione di ricerca

Start with tools/unpack-pbp.c and tools/psp-prxgen.c, then inspect the header and section definitions in tools/elftypes.h. Check how the tools read PBP offsets and ELF section names, and add validation for malformed input as described in the issue. Done means invalid offsets and overlong or unterminated section names are rejected safely; verify with the supplied reproductions or create equivalent malformed inputs.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

unpack-pbp: unvalidated offsets → attacker-sized output write (up to ~2 GiB per section); psp-prxgen: unbounded strcpy of section name

Two separate input-validation bugs in tools/. I'm reporting them privately rather than
posting full exploit detail: this repo has no SECURITY.md and "Private vulnerability
reporting" is disabled. Could you either enable it or tell me a preferred contact?

Both tools consume untrusted third-party artifacts (PBP / ELF), so the impact lands in
whatever developer machine or packaging pipeline processes such a file.

1. tools/unpack-pbp.c — header offsets are never validated (CWE-400 / CWE-1284)
if (loop0 == 7) size = total_size - header.offset[loop0];        /* :131 */
else            size = header.offset[loop0 + 1] - header.offset[loop0];  /* :133 */
if (!size) continue;                                             /* :140 */
...
readsize = size;                                                 /* :169 */
fread(buffer, readsize, 1, infile);                              /* :174 */
fwrite(buffer, readsize, 1, outfile);                            /* :182 */
} while (size);                                                  /* :189 */

The eight offsets come straight from the file and are never checked for monotonicity or
against the real file size; if (!size) is the only length gate, and it rejects exactly
zero. Two consequences, both reproduced by compiling the file as-is in a sandbox:

  • Attacker-sized output write. A 140-byte PBP with offset[7] = 0x7FFFFFF0 makes the
    tool write a DATA.PSP with no relation to the input size: the loop runs
    ceil(size / 16 MiB) times, so the section tops out at ~2 GiB and the tool then exits
    0. fread returns 0 at EOF, but the return value is only tested as result < 0 on a
    size_t — always false — so short reads go unnoticed and the stale 16 MB buffer keeps
    being written out (the tail of the file is unrelated heap content).
  • Negative length. offset[i+1] < offset[i] gives a negative size; on glibc the
    fread call then fails with EOVERFLOW and the tool silently writes a 0-byte file.
    No memory corruption there — I want to be precise about that, since it's the kind of
    thing that gets miscategorised.

Net effect: attacker-controlled disk consumption (~2 GiB per crafted section, and eight
sections are unpacked in one run) and silent clobbering of files in the working directory,
from a 140-byte input. Not a memory-safety bug, but it is a real
availability/integrity issue for anything that auto-processes PBPs.

2. tools/psp-prxgen.c — unbounded strcpy of the section name (CWE-121)
strcpy(g_elfsections[i].szName,
       (char *)(g_elfsections[g_elfhead.iShstrndx].pData + g_elfsections[i].iName));  /* :303 */

szName is char[ELF_SECT_MAX_NAME] = char[128] (tools/elftypes.h:20,49); the source
is the shstrtab string at the attacker-controlled sh_name offset, with no length check
and no guarantee of NUL-termination inside the table.

Reproduced: a hand-built 384-byte ELF whose section name is 200 bytes, compiled with
-D_FORTIFY_SOURCE=2, aborts with *** buffer overflow detected *** at :303; the same
file with a 100-byte name runs to the normal "no sceModuleInfo section found" path. Under
ASan the 200-byte name corrupts the adjacent ElfSection entries and faults inside
load_sections. 120 bytes of overflow into a global array — worth fixing regardless of
how the tool is invoked.

Fix for both: validate the PBP offset table right after the signature check
(non-decreasing, >= sizeof(HEADER), <= total_size, and reject short fread), and
bound the section-name copy to ELF_SECT_MAX_NAME - 1 while rejecting over-long names.

Happy to send the two input files and the build commands, and to open a PR against a
branch of your choosing.

Regards,
贵志的猫

Lingua principale
C
Stelle
1.2k
Fork
190
Merge medio
1g 15h
PR unite (30g)
12

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di pspdev/pspsdk

Tutte le issue di pspdev/pspsdk

Issue simili

Altre issue su C

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.