bugGNU nano - Bugs: bug #65407, stack smashing in rpl_glob() when...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #65407: stack smashing in rpl_glob() when an include path contains too many slashes

Submitter:  Kalle <nanouser123>
Submitted:  Sun 03 Mar 2024 09:02:06 AM UTC
   
 
Severity:  2 - Minor Status:  Fixed
Assigned to:  bens Open/Closed:  Open

Mon 04 Mar 2024 11:00:50 AM UTC, comment #3: 

Anyway, actually this is a problem in the gnulib globbing module, and it would be better to report it to bug-gnulib.

Benno Schulenberg <bens>
Group administrator
Mon 04 Mar 2024 10:49:19 AM UTC, comment #2: 

Avoided in git, commit f37d097c, by reporting an error when the include path has more characters than PATH_MAX.

(This limit is not low enough when compiling with -fsanitize=address, but... on normal installs nano is not compiled that way.)

Benno Schulenberg <bens>
Group administrator
Sun 03 Mar 2024 12:24:50 PM UTC, comment #1: 

A reduced recipe:

echo -n 'include "'  >badrc;
for count in $(seq 1293);
  do echo -n '/////';
done  >>badrc;
echo '"'  >>badrc

src/nano --rc=badrc

For the crash to happen, the string after an `include` command apparently needs to contain more than 6465 slashes.  It seems not very likely that someone would accept such a nanorc file from a stranger.

Benno Schulenberg <bens>
Group administrator
Sun 03 Mar 2024 09:02:06 AM UTC, original submission:  

Hi!

There is a bug when processing a malicious nanorc file, which causes a segfault. I have attached a POC file, which should crash the newest version of nano. To trigger the crash, just type nano -f crash.txt somefile.txt and it should segfault. I have also attached an address sanitizer report. This vulnerability was found through fuzzing with afl.

Kalle <nanouser123>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #55771:  asanreport.txt added by nanouser123 (24KiB - text/plain)
file #55772:  crash.txt added by nanouser123 (29KiB - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Posted a comment)
  • -email is unavailable- added by nanouser123 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-03-04 bens StatusNone Fixed
        Assigned toNone bens
        Summarystack smashing in rpl_glob() when loading a malicious nanorc file stack smashing in rpl_glob() when an include path contains too many slashes
    2024-03-03 bens Severity3 - Normal 2 - Minor
        SummaryStack smashing in rpl_glob in glob.c when loading a malicious nano rc file caused by an infinite loop. stack smashing in rpl_glob() when loading a malicious nanorc file
    2024-03-03 nanouser123 Attached File- Added asanreport.txt, #55771
        Attached File- Added crash.txt, #55772

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code