[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
bug#63063: CVE-2021-36699 report
From: |
Eli Zaretskii |
Subject: |
bug#63063: CVE-2021-36699 report |
Date: |
Tue, 25 Apr 2023 10:14:05 +0300 |
> From: fuomag9 <fuo@fuo.fi>
> Date: Mon, 24 Apr 2023 21:27:34 +0000
>
> I’m a security researcher and I’ve searched for a way to contact the emacs
> security team but I’ve not found any information online, so I’m reporting
> this issue here.
> I’ve discovered a buffer overflow in GNU Emacs 28.0.50 (at the time of
> writing the exploit still works on GNU Emacs 28.2)
> The issue is inside the --dump-file functionality of emacs, in particular
> dump_make_lv_from_reloc at pdumper.c:5239
> Attached to this email there's is payload used to make the vulnerability work
> (if emacs complains about a signature error you need to replace the hex bytes
> inside the payload with the expected one, since every emacs binary will
> expect a different signature).
> This issue has been assigned CVE-2021-36699 and thus I’m notifying you of
> this. (I do not think the emacs team is aware of this security issue)
> The POC is simple:
> Launch emacs --dump-file exploit, where exploit is a custom crafted emacs
> dump file
Please tell more about the buffer overflow: where does it happen in
the Emacs sources, which buffer overflows, and why. I cannot find
these details in your report.
Also, the CVE ID seems to be incorrect: if I look it up, I get some
SQL related issue, not an Emacs issue.
- bug#63063: CVE-2021-36699 report,
Eli Zaretskii <=
- bug#63063: CVE-2021-36699 report, Po Lu, 2023/04/25
- bug#63063: CVE-2021-36699 report, Eli Zaretskii, 2023/04/25
- bug#63063: CVE-2021-36699 report, Po Lu, 2023/04/25
- bug#63063: CVE-2021-36699 report, Eli Zaretskii, 2023/04/25
- bug#63063: CVE-2021-36699 report, Po Lu, 2023/04/25
- bug#63063: CVE-2021-36699 report, Eli Zaretskii, 2023/04/25
- bug#63063: CVE-2021-36699 report, Po Lu, 2023/04/25
- bug#63063: CVE-2021-36699 report, Eli Zaretskii, 2023/04/25
- bug#63063: CVE-2021-36699 report, Po Lu, 2023/04/25
- bug#63063: CVE-2021-36699 report, Eli Zaretskii, 2023/04/25