bugGNU Networking Utilities - Bugs: bug #61723, NULL Pointer Dereference in...

 
 

bug #61723: NULL Pointer Dereference in setnmap() at cmds.c:2303

Submitter:  AiDai <aidai>
Submitted:  Thu 23 Dec 2021 02:13:08 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 01 Oct 2022 04:42:55 PM UTC, comment #1: 
Erik Auerswald <auerswal>
Group Member
Thu 23 Dec 2021 02:13:08 PM UTC, original submission:  

# NULL Pointer Dereference in setnmap() at cmds.c:2303

## Description

A NULL Pointer Dereference was discovered in setnmap() at cmds.c:2303. The vulnerability causes a segmentation fault and application crash.

*version*

```
./ftp --version
ftp (GNU inetutils) 2.2.16-cf091
Copyright (C) 2021 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by many authors.
```

*System information*
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz

## Proof of Concept

*poc*

```
base64 poc
bm1hIBjyAoHzCcvLArnD/sreCvgmMwoKAPUKEBoKEAAKDgAAAIDn5+fn5wAABADn5+foA+f4FJ0r
CgoKCgoK538Kubn/gAArCgp/CgoKCgoKQn8K1rn/gAAKCgp/CgoKAN0=
```

*command:*

```
./ftp < ./poc
```

*Result*

```
./ftp < ./poc
[1]    728662 segmentation fault  ./ftp < ./poc
```

*gdb*

```
Program received signal SIGSEGV, Segmentation fault.
0x000055555555ec9d in setnmap (argc=3, argv=0x55555557e680 <margv>) at cmds.c:2303
2303      *cp = '\0';
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────────────────[ REGISTERS ]─────────────────────────────────────────────
 RAX  0x0
 RBX  0x5555555702c0 (__libc_csu_init) ◂— endbr64
 RCX  0x4
 RDX  0x0
 RDI  0x555555582aa0 ◂— 0x8102f21820616d6e
 RSI  0x20
 R8   0x555555583620 ◂— 0x8102f21800616d6e /* 'nma' */
 R9   0x7ffff7f5a010 (main_arena+1168) —▸ 0x7ffff7f5a000 (main_arena+1152) —▸ 0x7ffff7f59ff0 (main_arena+1136) —▸ 0x7ffff7f59fe0 (main_arena+1120) —▸ 0x7ffff7f59fd0 (main_arena+1104) ◂— ...
 R10  0x555555580010 ◂— 0x0
 R11  0x7ffff7f59be0 (main_arena+96) —▸ 0x5555555851a0 ◂— 0x0
 R12  0x555555559f30 (_start) ◂— endbr64
 R13  0x7fffffffe210 ◂— 0x1
 R14  0x0
 R15  0x0
 RBP  0x7fffffffe060 —▸ 0x7fffffffe0a0 —▸ 0x7fffffffe120 ◂— 0x0
 RSP  0x7fffffffe040 —▸ 0x55555557e680 (margv) —▸ 0x555555583620 ◂— 0x8102f21800616d6e /* 'nma' */
 RIP  0x55555555ec9d (setnmap+258) ◂— mov    byte ptr [rax], 0
──────────────────────────────────────────────[ DISASM ]──────────────────────────────────────────────
 ► 0x55555555ec9d <setnmap+258>    mov    byte ptr [rax], 0
   0x55555555eca0 <setnmap+261>    mov    rax, qword ptr [rip + 0x1ae49] <0x555555579af0>
   0x55555555eca7 <setnmap+268>    mov    rdi, rax
   0x55555555ecaa <setnmap+271>    call   rpl_free                <rpl_free>

   0x55555555ecaf <setnmap+276>    mov    rax, qword ptr [rip + 0x1f98a] <0x55555557e640>
   0x55555555ecb6 <setnmap+283>    mov    rdi, rax
   0x55555555ecb9 <setnmap+286>    call   strdup@plt                <strdup@plt>

   0x55555555ecbe <setnmap+291>    mov    qword ptr [rip + 0x1ae2b], rax <0x555555579af0>
   0x55555555ecc5 <setnmap+298>    jmp    setnmap+301                <setnmap+301>

   0x55555555ecc7 <setnmap+300>    nop
   0x55555555ecc8 <setnmap+301>    add    qword ptr [rbp - 8], 1
──────────────────────────────────────────[ SOURCE (CODE) ]───────────────────────────────────────────
In file: /root/disk2/fuzzing/inetutils/inetutils/ftp/cmds.c
   2298       while (*++cp == ' ')
   2299         continue;
   2300       altarg = cp;
   2301       cp = strchr (altarg, ' ');
   2302     }
 ► 2303   *cp = '\0';
   2304
   2305   free (mapin);
   2306   mapin = strdup (altarg);
   2307
   2308   while (*++cp == ' ')
──────────────────────────────────────────────[ STACK ]───────────────────────────────────────────────
00:0000│ rsp 0x7fffffffe040 —▸ 0x55555557e680 (margv) —▸ 0x555555583620 ◂— 0x8102f21800616d6e /* 'nma' */
01:0008│     0x7fffffffe048 ◂— 0x355583620
02:0010│     0x7fffffffe050 —▸ 0x5555555796c0 (cmdtab+2464) ◂— 0x0
03:0018│     0x7fffffffe058 ◂— 0x0
04:0020│ rbp 0x7fffffffe060 —▸ 0x7fffffffe0a0 —▸ 0x7fffffffe120 ◂— 0x0
05:0028│     0x7fffffffe068 —▸ 0x555555566a09 (cmdscanner+633) ◂— mov    eax, dword ptr [rip + 0x17bf5]
06:0030│     0x7fffffffe070 ◂— 0x0
07:0038│     0x7fffffffe078 ◂— 0x1c54c7100
────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────
 ► f 0   0x55555555ec9d setnmap+258
   f 1   0x555555566a09 cmdscanner+633
   f 2   0x55555556665a main+929
   f 3   0x7ffff7d950b3 __libc_start_main+243
──────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> bt
#0  0x000055555555ec9d in setnmap (argc=3, argv=0x55555557e680 <margv>) at cmds.c:2303
#1  0x0000555555566a09 in cmdscanner (top=1) at main.c:461
#2  0x000055555556665a in main (argc=0, argv=0x7fffffffe220) at main.c:310
#3  0x00007ffff7d950b3 in __libc_start_main (main=0x5555555662b9 <main>, argc=1, argv=0x7fffffffe218, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe208) at ../csu/libc-start.c:308
#4  0x0000555555559f5e in _start ()
```


AiDai <aidai>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by auerswal (Posted a comment)
  • -email is unavailable- added by aidai (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-10-01 auerswal Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code