[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[bug #61726] NULL Pointer Dereference in unsetcmd() at inetutils/telnet/
From: |
AiDai |
Subject: |
[bug #61726] NULL Pointer Dereference in unsetcmd() at inetutils/telnet/commands.c:1227 |
Date: |
Thu, 23 Dec 2021 09:14:18 -0500 (EST) |
User-agent: |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 |
URL:
<https://savannah.gnu.org/bugs/?61726>
Summary: NULL Pointer Dereference in unsetcmd() at
inetutils/telnet/commands.c:1227
Project: GNU Networking Utilities
Submitted by: aidai
Submitted on: Thu 23 Dec 2021 02:14:16 PM UTC
Category: None
Severity: 3 - Normal
Item Group: None
Status: None
Privacy: Public
Assigned to: None
Open/Closed: Open
Discussion Lock: Any
_______________________________________________________
Details:
# NULL Pointer Dereference in unsetcmd() at inetutils/telnet/commands.c:1227
## Description
A NULL Pointer Dereference was discovered in unsetcmd() at
inetutils/telnet/commands.c:1227. The vulnerability causes a segmentation
fault and application crash.
**version**
```
./telnet --version
telnet (GNU inetutils) 2.2.16-cf091
Copyright (C) 2021 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<https://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Written by many authors.
```
**System information**
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz
## Proof of Concept
**poc**
```
base64 poc
dQsiIA==
```
**command:**
```
./telnet < ./poc
```
**Result**
```
./telnet < ./poc
[3] 2387443 segmentation fault ./telnet < ./poc
```
**gdb**
```
Program received signal SIGSEGV, Segmentation fault.
unsetcmd (argc=0, argv=0x55555557c110 <margv+16>) at commands.c:1227
1227 *(ct->charp) = _POSIX_VDISABLE;
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────────────────[
REGISTERS
]─────────────────────────────────────────────
RAX 0x0
RBX 0x55555557bee2 (line+2) ◂— 0x20 /* ' ' */
RCX 0xfbad2098
RDX 0x0
RDI 0x55555557ab20 (Setlist+128) —▸ 0x555555571a7d ◂—
0x67756265640020 /* ' ' */
RSI 0x555555571a7d ◂— 0x67756265640020 /* ' ' */
R8 0x55555557bee0 (line) ◂— 0x200075 /* 'u' */
R9 0x7c
R10 0x555555572e4c ◂— 0x69626d413f00203e /* '> ' */
R11 0x246
R12 0x555555559d20 (_start) ◂— endbr64
R13 0x7fffffffe210 ◂— 0x1
R14 0x0
R15 0x0
RBP 0x7fffffffe060 —▸ 0x7fffffffe090 —▸ 0x7fffffffe120 ◂— 0x0
RSP 0x7fffffffe030 —▸ 0x55555557c110 (margv+16) ◂— 0x0
RIP 0x55555555b592 (unsetcmd+717) ◂— mov byte ptr [rax], 0
──────────────────────────────────────────────[
DISASM
]──────────────────────────────────────────────
► 0x55555555b592 <unsetcmd+717> mov byte ptr [rax], 0
0x55555555b595 <unsetcmd+720> mov rax, qword ptr [rbp - 0x20]
0x55555555b599 <unsetcmd+724> mov rax, qword ptr [rax + 0x18]
0x55555555b59d <unsetcmd+728> movzx eax, byte ptr [rax]
0x55555555b5a0 <unsetcmd+731> movzx eax, al
0x55555555b5a3 <unsetcmd+734> mov edi, eax
0x55555555b5a5 <unsetcmd+736> call control <control>
0x55555555b5aa <unsetcmd+741> mov rdx, rax
0x55555555b5ad <unsetcmd+744> mov rax, qword ptr [rbp - 0x20]
0x55555555b5b1 <unsetcmd+748> mov rax, qword ptr [rax]
0x55555555b5b4 <unsetcmd+751> mov rsi, rax
──────────────────────────────────────────[
SOURCE (CODE)
]───────────────────────────────────────────
In file: /root/disk2/fuzzing/inetutils/inetutils/telnet/commands.c
1222 (*ct->handler) (0);
1223 printf ("%s reset to \"%s\".\n", ct->name, (char *)
ct->charp);
1224 }
1225 else
1226 {
► 1227 *(ct->charp) = _POSIX_VDISABLE;
1228 printf ("%s character is '%s'.\n", ct->name,
1229 control (*(ct->charp)));
1230 }
1231 }
1232 return 1;
──────────────────────────────────────────────[
STACK
]───────────────────────────────────────────────
00:0000│ rsp 0x7fffffffe030 —▸ 0x55555557c110 (margv+16) ◂— 0x0
01:0008│ 0x7fffffffe038 ◂— 0x5555d867
02:0010│ 0x7fffffffe040 —▸ 0x55555557ab20 (Setlist+128) —▸
0x555555571a7d ◂— 0x67756265640020 /* ' ' */
03:0018│ 0x7fffffffe048 —▸ 0x55555557bee0 (line) ◂— 0x200075 /*
'u' */
04:0020│ 0x7fffffffe050 ◂— 0x0
05:0028│ 0x7fffffffe058 —▸ 0x55555557b360 (cmdtab+256) —▸
0x555555572e2f ◂— 0x6f74007465736e75 /* 'unset' */
06:0030│ rbp 0x7fffffffe060 —▸ 0x7fffffffe090 —▸ 0x7fffffffe120
◂— 0x0
07:0038│ 0x7fffffffe068 —▸ 0x55555555dab9 (command+550) ◂— test
eax, eax
────────────────────────────────────────────[
BACKTRACE
]─────────────────────────────────────────────
► f 0 0x55555555b592 unsetcmd+717
f 1 0x55555555dab9 command+550
f 2 0x55555555e3c8 main+776
f 3 0x7ffff7db50b3 __libc_start_main+243
──────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> bt
#0 unsetcmd (argc=0, argv=0x55555557c110 <margv+16>) at commands.c:1227
#1 0x000055555555dab9 in command (top=1, tbuf=0x0, cnt=0) at commands.c:3044
#2 0x000055555555e3c8 in main (argc=0, argv=0x7fffffffe220) at main.c:423
#3 0x00007ffff7db50b3 in __libc_start_main (main=0x55555555e0c0 <main>,
argc=1, argv=0x7fffffffe218, init=<optimized out>, fini=<optimized out>,
rtld_fini=<optimized out>, stack_end=0x7fffffffe208) at
../csu/libc-start.c:308
#4 0x0000555555559d4e in _start ()
```
_______________________________________________________
Reply to this item at:
<https://savannah.gnu.org/bugs/?61726>
_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [bug #61726] NULL Pointer Dereference in unsetcmd() at inetutils/telnet/commands.c:1227,
AiDai <=