bug-inetutils
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: NULL Pointer Dereference in help()


From: AiDai
Subject: Re: NULL Pointer Dereference in help()
Date: Thu, 23 Dec 2021 21:15:59 +0800

Line 1: # NULL Pointer Dereference in help() at inetutils/telnet/commands.c:3094

AiDai <wyxaidai@gmail.com> 于2021年12月23日周四 21:13写道:
**command:**

```
./telnet < ./poc
```

AiDai <wyxaidai@gmail.com> 于2021年12月23日周四 21:11写道:
# NULL Pointer Dereference in setnmap() at cmds.c:2303

## Description

A NULL Pointer Dereference was discovered in help() at inetutils/telnet/commands.c:3094. The vulnerability causes a segmentation fault and application crash.

**version**

```
./telnet --version
telnet (GNU inetutils) 2.2.16-cf091
Copyright (C) 2021 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by many authors.
```

**System information**
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz

## Proof of Concept

**poc**

```
base64 poc
ID8JCQn/CQn/CQj/////CQlkCQkJCQnwCQkJCQloCQkJCQn/////CQlkCQkJCQnwCQkJ7ekJCQkJ
CQkJCeoICQkZCQkJKiwJCQkJCQkJCQkJCQk=
```

**command:**

```
./ftp < ./poc
```

**Result**

```
./telnet < poc
telnet> ?Invalid help command �
?Invalid help command �
?Invalid help command����
display operating parameters
?Invalid help command �
[3]    398703 segmentation fault  ./telnet < poc
```

**gdb**

```
Breakpoint 2, 0x000055555555dbd3 in help (argc=8, argv=0x55555557c130 <margv+48>) at commands.c:3094
3094            printf ("%s\n", c->help);
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────────────────[ REGISTERS ]─────────────────────────────────────────────
*RAX  0x0
*RBX  0x55555557b480 (cmdtab2) —▸ 0x555555571232 ◂— 0x6f6400706c6568 /* 'help' */
 RCX  0x0
*RDX  0xc6
*RDI  0x0
*RSI  0x5555555719cc ◂— 0x646f6d7263 /* 'crmod' */
 R8   0x0
*R9   0x18
 R10  0x555555572ee2 ◂— 0x2500454d4f48000a /* '\n' */
 R11  0x246
*R12  0x55555557befd (line+29) ◂— 0xffff090909090068 /* 'h' */
 R13  0x7fffffffe210 ◂— 0x1
 R14  0x0
 R15  0x0
 RBP  0x7fffffffe060 —▸ 0x7fffffffe090 —▸ 0x7fffffffe120 ◂— 0x0
 RSP  0x7fffffffe040 —▸ 0x55555557c130 (margv+48) —▸ 0x55555557befd (line+29) ◂— 0xffff090909090068 /* 'h' */
 RIP  0x55555555dbd3 (help+212) ◂— call   0x555555559790
──────────────────────────────────────────────[ DISASM ]──────────────────────────────────────────────
   0x55555555dbcc <help+205>    mov    rax, qword ptr [rbx + 8]
   0x55555555dbd0 <help+209>    mov    rdi, rax
 ► 0x55555555dbd3 <help+212>    call   puts@plt                <puts@plt>
        s: 0x0

   0x55555555dbd8 <help+217>    sub    dword ptr [rbp - 0x14], 1
   0x55555555dbdc <help+221>    cmp    dword ptr [rbp - 0x14], 0
   0x55555555dbe0 <help+225>    jg     help+116                <help+116>

   0x55555555dbe2 <help+227>    mov    eax, 0
   0x55555555dbe7 <help+232>    add    rsp, 0x10
   0x55555555dbeb <help+236>    pop    rbx
   0x55555555dbec <help+237>    pop    r12
   0x55555555dbee <help+239>    pop    rbp
──────────────────────────────────────────[ SOURCE (CODE) ]───────────────────────────────────────────
In file: /root/disk2/fuzzing/inetutils/inetutils/telnet/commands.c
   3089       if (Ambiguous (c))
   3090         printf ("?Ambiguous help command %s\n", arg);
   3091       else if (c == (Command *) 0)
   3092         printf ("?Invalid help command %s\n", arg);
   3093       else
 ► 3094         printf ("%s\n", c->help);
   3095     }
   3096   return 0;
   3097 }
   3098
   3099 static char *rcname = 0;
──────────────────────────────────────────────[ STACK ]───────────────────────────────────────────────
00:0000│ rsp 0x7fffffffe040 —▸ 0x55555557c130 (margv+48) —▸ 0x55555557befd (line+29) ◂— 0xffff090909090068 /* 'h' */
01:0008│     0x7fffffffe048 ◂— 0x85557bee1
02:0010│     0x7fffffffe050 —▸ 0x55555557b440 (cmdtab+480) —▸ 0x55555557121b ◂— 0x616c70736944003f /* '?' */
03:0018│     0x7fffffffe058 —▸ 0x555555559d20 (_start) ◂— endbr64
04:0020│ rbp 0x7fffffffe060 —▸ 0x7fffffffe090 —▸ 0x7fffffffe120 ◂— 0x0
05:0028│     0x7fffffffe068 —▸ 0x55555555dab9 (command+550) ◂— test   eax, eax
06:0030│     0x7fffffffe070 ◂— 0x0
07:0038│     0x7fffffffe078 ◂— 0x100000000
────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────
 ► f 0   0x55555555dbd3 help+212
   f 1   0x55555555dab9 command+550
   f 2   0x55555555e3c8 main+776
   f 3   0x7ffff7db50b3 __libc_start_main+243
──────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> bt
#0  0x000055555555dbd3 in help (argc=8, argv=0x55555557c130 <margv+48>) at commands.c:3094
#1  0x000055555555dab9 in command (top=1, tbuf=0x0, cnt=0) at commands.c:3044
#2  0x000055555555e3c8 in main (argc=0, argv=0x7fffffffe220) at main.c:423
#3  0x00007ffff7db50b3 in __libc_start_main (main=0x55555555e0c0 <main>, argc=1, argv=0x7fffffffe218, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe208) at ../csu/libc-start.c:308
#4  0x0000555555559d4e in _start ()
```

crash

```
Program received signal SIGSEGV, Segmentation fault.
__strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:65
65      ../sysdeps/x86_64/multiarch/strlen-avx2.S: No such file or directory.
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────────────────[ REGISTERS ]─────────────────────────────────────────────
 RAX  0x0
 RBX  0x55555557b480 (cmdtab2) —▸ 0x555555571232 ◂— 0x6f6400706c6568 /* 'help' */
 RCX  0x0
*RDX  0x0
 RDI  0x0
 RSI  0x5555555719cc ◂— 0x646f6d7263 /* 'crmod' */
 R8   0x0
 R9   0x18
 R10  0x555555572ee2 ◂— 0x2500454d4f48000a /* '\n' */
 R11  0x246
*R12  0x0
 R13  0x7fffffffe210 ◂— 0x1
 R14  0x0
 R15  0x0
 RBP  0x7fffffffe060 —▸ 0x7fffffffe090 —▸ 0x7fffffffe120 ◂— 0x0
*RSP  0x7fffffffe008 —▸ 0x7ffff7e155b4 (puts+20) ◂— mov    r13, qword ptr [rip + 0x16398d]
*RIP  0x7ffff7f19675 (__strlen_avx2+21) ◂— vpcmpeqb ymm1, ymm0, ymmword ptr [rdi]
──────────────────────────────────────────────[ DISASM ]──────────────────────────────────────────────
 ► 0x7ffff7f19675 <__strlen_avx2+21>     vpcmpeqb ymm1, ymm0, ymmword ptr [rdi]
   0x7ffff7f19679 <__strlen_avx2+25>     vpmovmskb eax, ymm1
   0x7ffff7f1967d <__strlen_avx2+29>     test   eax, eax
   0x7ffff7f1967f <__strlen_avx2+31>     jne    __strlen_avx2+272                <__strlen_avx2+272>
    ↓
   0x7ffff7f19770 <__strlen_avx2+272>    tzcnt  eax, eax
   0x7ffff7f19774 <__strlen_avx2+276>    add    rax, rdi
   0x7ffff7f19777 <__strlen_avx2+279>    sub    rax, rdx
   0x7ffff7f1977a <__strlen_avx2+282>    vzeroupper
   0x7ffff7f1977d <__strlen_avx2+285>    ret

   0x7ffff7f1977e <__strlen_avx2+286>    nop
   0x7ffff7f19780 <__strlen_avx2+288>    tzcnt  eax, eax
──────────────────────────────────────────────[ STACK ]───────────────────────────────────────────────
00:0000│ rsp 0x7fffffffe008 —▸ 0x7ffff7e155b4 (puts+20) ◂— mov    r13, qword ptr [rip + 0x16398d]
01:0008│     0x7fffffffe010 —▸ 0x55555557b480 (cmdtab2) —▸ 0x555555571232 ◂— 0x6f6400706c6568 /* 'help' */
02:0010│     0x7fffffffe018 —▸ 0x7fffffffe060 —▸ 0x7fffffffe090 —▸ 0x7fffffffe120 ◂— 0x0
03:0018│     0x7fffffffe020 —▸ 0x55555557befd (line+29) ◂— 0xffff090909090068 /* 'h' */
04:0020│     0x7fffffffe028 —▸ 0x7fffffffe210 ◂— 0x1
05:0028│     0x7fffffffe030 ◂— 0x0
06:0030│     0x7fffffffe038 —▸ 0x55555555dbd8 (help+217) ◂— sub    dword ptr [rbp - 0x14], 1
07:0038│     0x7fffffffe040 —▸ 0x55555557c130 (margv+48) —▸ 0x55555557befd (line+29) ◂— 0xffff090909090068 /* 'h' */
────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────
 ► f 0   0x7ffff7f19675 __strlen_avx2+21
   f 1   0x7ffff7e155b4 puts+20
   f 2   0x55555555dbd8 help+217
   f 3   0x55555555dab9 command+550
   f 4   0x55555555e3c8 main+776
   f 5   0x7ffff7db50b3 __libc_start_main+243
```


reply via email to

[Prev in Thread] Current Thread [Next in Thread]