`unpack-pbp`: unvalidated PBP offsets → silent file clobbering and attacker-sized write; `psp-prxgen`: unbounded `strcpy` of section name

オープン
  • 何か問題がありますか？
#412 コメント 4 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
45/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
c
領域
security, tooling

調査の方向性

Start with tools/unpack-pbp.c and tools/psp-prxgen.c, then inspect the header and section definitions in tools/elftypes.h. Check how the tools read PBP offsets and ELF section names, and add validation for malformed input as described in the issue. Done means invalid offsets and overlong or unterminated section names are rejected safely; verify with the supplied reproductions or create equivalent malformed inputs.

索引モデルが issue の本文から書いたものです。

説明

unpack-pbp: unvalidated offsets → attacker-sized output write (up to ~2 GiB per section); psp-prxgen: unbounded strcpy of section name

Two separate input-validation bugs in tools/. I'm reporting them privately rather than
posting full exploit detail: this repo has no SECURITY.md and "Private vulnerability
reporting" is disabled. Could you either enable it or tell me a preferred contact?

Both tools consume untrusted third-party artifacts (PBP / ELF), so the impact lands in
whatever developer machine or packaging pipeline processes such a file.

1. tools/unpack-pbp.c — header offsets are never validated (CWE-400 / CWE-1284)
if (loop0 == 7) size = total_size - header.offset[loop0];        /* :131 */
else            size = header.offset[loop0 + 1] - header.offset[loop0];  /* :133 */
if (!size) continue;                                             /* :140 */
...
readsize = size;                                                 /* :169 */
fread(buffer, readsize, 1, infile);                              /* :174 */
fwrite(buffer, readsize, 1, outfile);                            /* :182 */
} while (size);                                                  /* :189 */

The eight offsets come straight from the file and are never checked for monotonicity or
against the real file size; if (!size) is the only length gate, and it rejects exactly
zero. Two consequences, both reproduced by compiling the file as-is in a sandbox:

  • Attacker-sized output write. A 140-byte PBP with offset[7] = 0x7FFFFFF0 makes the
    tool write a DATA.PSP with no relation to the input size: the loop runs
    ceil(size / 16 MiB) times, so the section tops out at ~2 GiB and the tool then exits
    0. fread returns 0 at EOF, but the return value is only tested as result < 0 on a
    size_t — always false — so short reads go unnoticed and the stale 16 MB buffer keeps
    being written out (the tail of the file is unrelated heap content).
  • Negative length. offset[i+1] < offset[i] gives a negative size; on glibc the
    fread call then fails with EOVERFLOW and the tool silently writes a 0-byte file.
    No memory corruption there — I want to be precise about that, since it's the kind of
    thing that gets miscategorised.

Net effect: attacker-controlled disk consumption (~2 GiB per crafted section, and eight
sections are unpacked in one run) and silent clobbering of files in the working directory,
from a 140-byte input. Not a memory-safety bug, but it is a real
availability/integrity issue for anything that auto-processes PBPs.

2. tools/psp-prxgen.c — unbounded strcpy of the section name (CWE-121)
strcpy(g_elfsections[i].szName,
       (char *)(g_elfsections[g_elfhead.iShstrndx].pData + g_elfsections[i].iName));  /* :303 */

szName is char[ELF_SECT_MAX_NAME] = char[128] (tools/elftypes.h:20,49); the source
is the shstrtab string at the attacker-controlled sh_name offset, with no length check
and no guarantee of NUL-termination inside the table.

Reproduced: a hand-built 384-byte ELF whose section name is 200 bytes, compiled with
-D_FORTIFY_SOURCE=2, aborts with *** buffer overflow detected *** at :303; the same
file with a 100-byte name runs to the normal "no sceModuleInfo section found" path. Under
ASan the 200-byte name corrupts the adjacent ElfSection entries and faults inside
load_sections. 120 bytes of overflow into a global array — worth fixing regardless of
how the tool is invoked.

Fix for both: validate the PBP offset table right after the signature check
(non-decreasing, >= sizeof(HEADER), <= total_size, and reject short fread), and
bound the section-name copy to ELF_SECT_MAX_NAME - 1 while rejecting over-long names.

Happy to send the two input files and the build commands, and to open a PR against a
branch of your choosing.

Regards,
贵志的猫

主要言語
C
スター
1.2k
フォーク
190
平均マージ
1日 15時間
マージ済み PR（30日）
12

環境構築

  • Dockerfile または Docker Compose ファイルあり
  • プルリクエストのテンプレートなし
  • コントリビューションガイドなし

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

pspdev/pspsdk のほかの issue

pspdev/pspsdk の issue をすべて見る

似ている issue

C の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。