首页
社区
课程
招聘
问答 CTF 排行榜 知识库 工具下载 峰会 看雪商城 证书查询
  1. 社区
  2. 二进制漏洞
    3. 发新帖
Fuzzing101-Exercise2 fuzz CVE-2009-3895和CVE-2012-2836
发表于: 2023-4-28 17:42 11040

Fuzzing101-Exercise2 fuzz CVE-2009-3895和CVE-2012-2836

Cx1ng 活跃值
1
2023-4-28 17:42
11040

autor: cxing
date: 2023年4月28日

 

我们将对libexif 0.6.14进行fuzz，目标是复现CVE-2009-3895 和CVE-2012-2836 两个漏洞。

0x00 准备工作

我们先了解一下libexif这个库和两个CVE漏洞。
关于libexif的信息如下：

  • is a library written in pure portable C.
  • reads and writes EXIF metainformation from and to image files.
  • is licensed under the GNU [LESSER GENERAL PUBLIC LICENSE
  • runs under POSIX systems (e.g. GNU/Linux, xBSD, MacOS X, Windows, etc.).

Digital cameras store a surprising amount of information inside each picture they take, in a normally invisible format known as EXIF. Everything from photo basics like the camera shutter speed and aperture to the GPS location and even the name of the camera owner can be hidden inside each photograph. libexif is a library that lets you access that data from within a computer program. Some simple applications called exif and gexif are also supplied alongside libexif that use it to view EXIF data from the command-line or GUI (respectively).

  • 是一个用纯可移植 C 编写的库。
  • 从图像文件读取和写入 EXIF 元信息。
  • 根据 GNU 宽通用公共许可证版本 2.1 （LGPL） 进行许可。
  • 在POSIX系统（例如GNU/Linux，xBSD，MacOS X，Windows等）下运行。

数码相机在每张照片中存储了惊人的信息量 它们以一种通常不可见的格式（称为EXIF）采用。照片中的所有内容 基本功能，例如相机快门速度和 GPS 位置的光圈以及 甚至相机所有者的名字也可以隐藏在每张照片中。利贝西夫 是一个库，可让您从计算机程序内访问该数据。 一些称为 exif 和 gexif 的简单应用程序也与 libexif 一起提供，这些应用程序使用它来查看来自 命令行或 GUI。

 

阿里云漏洞库上关于CVE-2009-3895的描述如下：
图片描述
关于CVE-2012-2836的描述：
图片描述

0x01 环境搭建

在你的工作目录下载fuzz目标库，harness，以及种子语料库(seed corpus)。

1
2
3
4
5
6
7
8
9
10
11
# fuzz target
wget https://github.com/libexif/libexif/archive/refs/tags/libexif-0_6_14-release.tar.gz
tar -xzvf libexif-0_6_14-release.tar.gz
 
# harness
wget https://github.com/libexif/exif/archive/refs/tags/exif-0_6_15-release.tar.gz
tar -xzvf exif-0_6_15-release.tar.gz
 
# seed corpus
wget https://github.com/ianare/exif-samples/archive/refs/heads/master.zip
unzip master.zip

安装必要库并编译一个调试版本。

1
2
3
4
5
6
7
8
9
10
11
12
13
sudo apt-get install autopoint libtool gettext libpopt-dev
 
cd libexif-libexif-0_6_14-release/
autoreconf -fvi
CFLAGS="-g -O0" ./configure --enable-shared=no --prefix=$HOME/fuzzing/libexif/dbg_install/
make -j4
make install
 
cd exif-exif-0_6_15-release/
autoreconf -fvi
CFLAGS="-g -O0" ./configure --enable-shared=no --prefix=$HOME/fuzzing/libexif/dbg_install/ PKG_CONFIG_PATH=$HOME/fuzzing/libexif/dbg_install/lib/pkgconfig
make -j4
make install

编译出一个fuzz版本

1
2
3
4
5
6
7
8
9
10
11
12
cd libexif-libexif-0_6_14-release/
# export LLVM_CONFIG="llvm-config-14"
CC=afl-clang-lto ./configure --enable-shared=no --prefix=$HOME/fuzzing/libexif/fuzz_install/
make clean
make -j4
make install
 
cd exif-exif-0_6_15-release/
CC=afl-clang-lto ./configure --enable-shared=no --prefix=$HOME/fuzzing/libexif/fuzz_install/ PKG_CONFIG_PATH=$HOME/fuzzing/libexif/fuzz_install/lib/pkgconfig
make clean
make -j4
make install

注1：export LLVM_CONFIG="llvm-config-14"对于使用官方docker进行fuzz的人来说，这条命令是非必要的，因为官方镜像中已经设置好永久的环境变量了。可以检测自己的环境中是否存在该变量，若没有则需要执行该语句添加环境变量，具体的值需要根据你本机环境中llvm的版本来确定，最好的默认版本，版本至少是llvm-11或更高。
注2：由于是库文件，我们没办法直接输入，因此需要一个harness。假设当前需要对产品进行Fuzzing测试，一般需要一个支持命令行的测试程序，通常称为harness。具体到本案例，你可以简单理解位库函数提供的是接口，而我们需要让接口接入我们的fuzz，即我们需要编写一些代码去调用这些接口，然后我们才能不断的用语料库的输入去测试库函数的接口。这里我们没有使用自己写的harness，而寻找到了一些现场的使用这些接口的应用程序，对他们的测试可以直接测试到libexif，只需要静态编译即可。
注3：如果你不太理解configure文件的参数，可以自行运行-h，里面有详细说明。
注4：我们使用的是afl-clang-lto，afl-clang-lto通常是最好的选择，关于afl-clang-lto的更多信息在官方库有非常详细的介绍，包括其工作原理，具体的开源查阅这里https://github.com/AFLplusplus/AFLplusplus/blob/stable/instrumentation/README.lto.md

0x02 fuzzing

现在我们已经准备就绪，开始fuzz！

1
afl-fuzz -i $HOME/fuzzing/libexif/exif-samples-master/jpg/ -o $HOME/fuzzing/libexif/fuzz_out/ -s 123 -- $HOME/fuzzing/libexif/fuzz_install/bin/exif @@

注5：-s是设置随机变异种子，该值将影响种子语料的变异，--之后是目标应用程序运行命令，其中@@表示我们的语料库以文件形式输入被应用程序读取。

 

运行大约十分钟后，我们获得了17个crash和1个hangs。
图片描述

0x03 输入样本分析

我们利用调试版本编译的对这些样本进行分析，经过gdb调试分析（也可以利用类似于afl-collect的工具进行自动的分类，但因为crash样本并不多我就直接手动分析了），我们总共分类出五类，其中四类是crash，一类是hangs。
可以看到本质上crash就是两类，分别是最终结果exif_entry_fix和exif_data_load_data，而hangs是一个无线递归漏洞。exif_entry_fix处发生的漏洞就是CVE-2009-3895，exif_data_load_data处的漏洞就是CVE-2012-2836。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// crash_1
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
   87 exif_get_sshort (const unsigned char *buf, ExifByteOrder order)
   88 {
   89         if (!buf) return 0;
   90         switch (order) {
   91         case EXIF_BYTE_ORDER_MOTOROLA:
 ► 92                 return ((buf[0] << 8) | buf[1]);
   93         case EXIF_BYTE_ORDER_INTEL:
   94                 return ((buf[1] << 8) | buf[0]);
   95         }
 
#0  0x000055555556de54 in exif_get_sshort (buf=0x555655593e93 <error: Cannot access memory at address 0x555655593e93>, order=EXIF_BYTE_ORDER_MOTOROLA) at exif-utils.c:92
#1  0x000055555556debd in exif_get_short (buf=0x555655593e93 <error: Cannot access memory at address 0x555655593e93>, order=EXIF_BYTE_ORDER_MOTOROLA) at exif-utils.c:104
#2  0x0000555555564dbb in exif_data_load_data (data=0x555555594320, d_orig=0x555555593e90 "Exif", ds_orig=824) at exif-data.c:819
#3  0x000055555556c86f in exif_loader_get_data (loader=0x555555593e40) at exif-loader.c:387
#4  0x000055555556002c in main (argc=2, argv=0x7fffffffdec8) at main.c:438
#5  0x00007ffff7c29d90 in __libc_start_call_main (main=main@entry=0x55555555f673 <main>, argc=argc@entry=2, argv=argv@entry=0x7fffffffdec8) at ../sysdeps/nptl/libc_start_call_main.h:58
#6  0x00007ffff7c29e40 in __libc_start_main_impl (main=0x55555555f673 <main>, argc=2, argv=0x7fffffffdec8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdeb8) at ../csu/libc-start.c:392
#7  0x000055555555d7a5 in _start ()
 
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// crash_2
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
 
   130 exif_get_slong (const unsigned char *b, ExifByteOrder order)
   131 {
   132         if (!b) return 0;
   133         switch (order) {
   134         case EXIF_BYTE_ORDER_MOTOROLA:
 ► 135                 return ((b[0] << 24) | (b[1] << 16) | (b[2] << 8) | b[3]);
   136         case EXIF_BYTE_ORDER_INTEL:
   137                 return ((b[3] << 24) | (b[2] << 16) | (b[1] << 8) | b[0]);
   138         }
 
#0  0x000055555556df97 in exif_get_slong (b=0x5555555b2000 <error: Cannot access memory at address 0x5555555b2000>, order=EXIF_BYTE_ORDER_MOTOROLA) at exif-utils.c:135
#1  0x000055555556e101 in exif_get_long (buf=0x5555555b2000 <error: Cannot access memory at address 0x5555555b2000>, order=EXIF_BYTE_ORDER_MOTOROLA) at exif-utils.c:167
#2  0x0000555555566188 in exif_entry_fix (e=0x5555555965d0) at exif-entry.c:193
#3  0x000055555556288f in fix_func (e=0x5555555965d0, data=0x0) at exif-content.c:231
#4  0x0000555555562726 in exif_content_foreach_entry (content=0x555555594450, func=0x55555556286f <fix_func>, data=0x0) at exif-content.c:200
#5  0x00005555555628eb in exif_content_fix (c=0x555555594450) at exif-content.c:247
#6  0x0000555555565a22 in fix_func (c=0x555555594450, data=0x0) at exif-data.c:1169
#7  0x00005555555655b6 in exif_data_foreach_content (data=0x555555594320, func=0x555555565960 <fix_func>, user_data=0x0) at exif-data.c:1031
#8  0x0000555555565a51 in exif_data_fix (d=0x555555594320) at exif-data.c:1176
#9  0x0000555555565008 in exif_data_load_data (data=0x555555594320, d_orig=0x555555593e90 "Exif", ds_orig=1126) at exif-data.c:871
#10 0x000055555556c86f in exif_loader_get_data (loader=0x555555593e40) at exif-loader.c:387
#11 0x000055555556002c in main (argc=2, argv=0x7fffffffdec8) at main.c:438
#12 0x00007ffff7c29d90 in __libc_start_call_main (main=main@entry=0x55555555f673 <main>, argc=argc@entry=2, argv=argv@entry=0x7fffffffdec8) at ../sysdeps/nptl/libc_start_call_main.h:58
#13 0x00007ffff7c29e40 in __libc_start_main_impl (main=0x55555555f673 <main>, argc=2, argv=0x7fffffffdec8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdeb8) at ../csu/libc-start.c:392
#14 0x000055555555d7a5 in _start ()
 
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// crash_3
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
 
───────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────
 ► 0x7ffff7da0ed8 <__memmove_avx_unaligned_erms+1432>    vmovdqu ymm13, ymmword ptr [rsi + 0x3020]
   0x7ffff7da0ee0 <__memmove_avx_unaligned_erms+1440>    vmovdqu ymm14, ymmword ptr [rsi + 0x3040]
   0x7ffff7da0ee8 <__memmove_avx_unaligned_erms+1448>    vmovdqu ymm15, ymmword ptr [rsi + 0x3060]
   0x7ffff7da0ef0 <__memmove_avx_unaligned_erms+1456>    sub    rsi, -0x80
   0x7ffff7da0ef4 <__memmove_avx_unaligned_erms+1460>    vmovntdq ymmword ptr [rdi], ymm0
   0x7ffff7da0ef8 <__memmove_avx_unaligned_erms+1464>    vmovntdq ymmword ptr [rdi + 0x20], ymm1
   0x7ffff7da0efd <__memmove_avx_unaligned_erms+1469>    vmovntdq ymmword ptr [rdi + 0x40], ymm2
   0x7ffff7da0f02 <__memmove_avx_unaligned_erms+1474>    vmovntdq ymmword ptr [rdi + 0x60], ymm3
   0x7ffff7da0f07 <__memmove_avx_unaligned_erms+1479>    vmovntdq ymmword ptr [rdi + 0x1000], ymm4
   0x7ffff7da0f0f <__memmove_avx_unaligned_erms+1487>    vmovntdq ymmword ptr [rdi + 0x1020], ymm5
 
#0  0x00007ffff7da0ed8 in __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:874
#1  0x0000555555571991 in exif_mnote_data_olympus_load (en=0x555555598c60, buf=0x5555555969b0 "Exif", buf_size=4786) at exif-mnote-data-olympus.c:357
#2  0x000055555556d163 in exif_mnote_data_load (d=0x555555598c60, buf=0x5555555969b0 "Exif", buf_size=4786) at exif-mnote-data.c:84
#3  0x0000555555564fea in exif_data_load_data (data=0x555555593e90, d_orig=0x5555555969b0 "Exif", ds_orig=4786) at exif-data.c:867
#4  0x000055555556c86f in exif_loader_get_data (loader=0x555555593e40) at exif-loader.c:387
#5  0x000055555556002c in main (argc=2, argv=0x7fffffffdec8) at main.c:438
#6  0x00007ffff7c29d90 in __libc_start_call_main (main=main@entry=0x55555555f673 <main>, argc=argc@entry=2, argv=argv@entry=0x7fffffffdec8) at ../sysdeps/nptl/libc_start_call_main.h:58
#7  0x00007ffff7c29e40 in __libc_start_main_impl (main=0x55555555f673 <main>, argc=2, argv=0x7fffffffdec8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdeb8) at ../csu/libc-start.c:392
#8  0x000055555555d7a5 in _start ()
 
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// crash_4
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
───────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────
 ► 0x7ffff7da0ed0 <__memmove_avx_unaligned_erms+1424>    vmovdqu ymm12, ymmword ptr [rsi + 0x3000]
   0x7ffff7da0ed8 <__memmove_avx_unaligned_erms+1432>    vmovdqu ymm13, ymmword ptr [rsi + 0x3020]
   0x7ffff7da0ee0 <__memmove_avx_unaligned_erms+1440>    vmovdqu ymm14, ymmword ptr [rsi + 0x3040]
   0x7ffff7da0ee8 <__memmove_avx_unaligned_erms+1448>    vmovdqu ymm15, ymmword ptr [rsi + 0x3060]
   0x7ffff7da0ef0 <__memmove_avx_unaligned_erms+1456>    sub    rsi, -0x80
 
#0  __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:874
#1  0x00005555555633d9 in exif_data_load_data_thumbnail (data=0x555555593e90, d=0x5555555969b6 "II*", ds=4754, offset=1, size=4294967295) at exif-data.c:292
#2  0x00005555555638c8 in exif_data_load_data_content (data=0x555555593e90, ifd=EXIF_IFD_INTEROPERABILITY, d=0x5555555969b6 "II*", ds=4754, offset=2, recursion_depth=1) at exif-data.c:374
#3  0x0000555555563898 in exif_data_load_data_content (data=0x555555593e90, ifd=EXIF_IFD_0, d=0x5555555969b6 "II*", ds=4754, offset=10, recursion_depth=0) at exif-data.c:369
#4  0x0000555555564d8a in exif_data_load_data (data=0x555555593e90, d_orig=0x5555555969b0 "Exif", ds_orig=4760) at exif-data.c:813
#5  0x000055555556c86f in exif_loader_get_data (loader=0x555555593e40) at exif-loader.c:387
#6  0x000055555556002c in main (argc=2, argv=0x7fffffffdec8) at main.c:438
#7  0x00007ffff7c29d90 in __libc_start_call_main (main=main@entry=0x55555555f673 <main>, argc=argc@entry=2, argv=argv@entry=0x7fffffffdec8) at ../sysdeps/nptl/libc_start_call_main.h:58
#8  0x00007ffff7c29e40 in __libc_start_main_impl (main=0x55555555f673 <main>, argc=2, argv=0x7fffffffdec8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdeb8) at ../csu/libc-start.c:392
#9  0x000055555555d7a5 in _start ()
 
 
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// hang_1
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
In file: /home/cxing/fuzzing/libexif/exif-exif-0_6_15-release/exif/main.c
   190         } while (0)
   191
   192 static void
   193 log_func_exit (ExifLog *log, ExifLogCode code, const char *domain,
   194                 const char *format, va_list args, void *data)
 ► 195 {
   196         switch (code) {
   197         case -1:
   198                 put_colorstring (stderr, COL_RED);
   199                 vfprintf (stderr, format, args);
   200                 fprintf (stderr, "\n");
 
pwndbg> bt 20
#0  0x000055555555eeb4 in log_func_exit (log=0x555555593de0, code=EXIF_LOG_CODE_DEBUG, domain=0x555555579b96 "ExifLoader", format=0x555555579ba8 "Scanning %i byte(s) of data...", args=<error reading variable: Cannot access memory at address 0x7fffff7feff8>, data=<error reading variable: Cannot access memory at address 0x7fffff7feff0>) at main.c:195
#1  0x000055555556ccbe in exif_logv (log=0x555555593de0, code=EXIF_LOG_CODE_DEBUG, domain=0x555555579b96 "ExifLoader", format=0x555555579ba8 "Scanning %i byte(s) of data...", args=0x7fffff7ff090) at exif-log.c:147
#2  0x000055555556cc42 in exif_log (log=0x555555593de0, code=EXIF_LOG_CODE_DEBUG, domain=0x555555579b96 "ExifLoader", format=0x555555579ba8 "Scanning %i byte(s) of data...") at exif-log.c:137
#3  0x000055555556c196 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:179
#4  0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#5  0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#6  0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#7  0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#8  0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#9  0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#10 0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#11 0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#12 0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#13 0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#14 0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#15 0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#16 0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#17 0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#18 0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#19 0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
(More stack frames follow...)
 
#0  exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:151
#1  0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#2  0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#3  0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#4  0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd1b0 "", len=0) at exif-loader.c:301
#5  0x000055555556c631 in exif_loader_write (eld=0x555555593e40, buf=0x7fffffffd19c "Ex", '\330' <repeats 17 times>, <incomplete sequence \330>, len=20) at exif-loader.c:301
#6  0x000055555556bf65 in exif_loader_write_file (l=0x555555593e40, path=0x555555593d90 "../../hang_1") at exif-loader.c:120
#7  0x000055555556001d in main (argc=2, argv=0x7fffffffdeb8) at main.c:437
#8  0x00007ffff7c29d90 in __libc_start_call_main (main=main@entry=0x55555555f673 <main>, argc=argc@entry=2, argv=argv@entry=0x7fffffffdeb8) at ../sysdeps/nptl/libc_start_call_main.h:58
#9  0x00007ffff7c29e40 in __libc_start_main_impl (main=0x55555555f673 <main>, argc=2, argv=0x7fffffffdeb8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdea8) at ../csu/libc-start.c:392
#10 0x000055555555d7a5 in _start ()

CVE-2009-3895 crash分析

我们先分析exif_entry_fix导致的CVE-2009-3895。我们看crash_2。根据堆栈回溯#0和#1提示buf/b=0x5555555b2000 <error: Cannot access memory at address 0x5555555b2000>。
查看内存布局，显然buf和b本来是堆内存，但是不知道怎么的变成指向堆的边界之外了，我们回到exif_entry_fix查看具体是什么情况。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// crash_2
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
 
   130 exif_get_slong (const unsigned char *b, ExifByteOrder order)
   131 {
   132         if (!b) return 0;
   133         switch (order) {
   134         case EXIF_BYTE_ORDER_MOTOROLA:
 ► 135                 return ((b[0] << 24) | (b[1] << 16) | (b[2] << 8) | b[3]);
   136         case EXIF_BYTE_ORDER_INTEL:
   137                 return ((b[3] << 24) | (b[2] << 16) | (b[1] << 8) | b[0]);
   138         }
 
#0  0x000055555556df97 in exif_get_slong (b=0x5555555b2000 <error: Cannot access memory at address 0x5555555b2000>, order=EXIF_BYTE_ORDER_MOTOROLA) at exif-utils.c:135
#1  0x000055555556e101 in exif_get_long (buf=0x5555555b2000 <error: Cannot access memory at address 0x5555555b2000>, order=EXIF_BYTE_ORDER_MOTOROLA) at exif-utils.c:167
#2  0x0000555555566188 in exif_entry_fix (e=0x5555555965d0) at exif-entry.c:193
#3  0x000055555556288f in fix_func (e=0x5555555965d0, data=0x0) at exif-content.c:231
#4  0x0000555555562726 in exif_content_foreach_entry (content=0x555555594450, func=0x55555556286f <fix_func>, data=0x0) at exif-content.c:200
#5  0x00005555555628eb in exif_content_fix (c=0x555555594450) at exif-content.c:247
#6  0x0000555555565a22 in fix_func (c=0x555555594450, data=0x0) at exif-data.c:1169
#7  0x00005555555655b6 in exif_data_foreach_content (data=0x555555594320, func=0x555555565960 <fix_func>, user_data=0x0) at exif-data.c:1031
#8  0x0000555555565a51 in exif_data_fix (d=0x555555594320) at exif-data.c:1176
#9  0x0000555555565008 in exif_data_load_data (data=0x555555594320, d_orig=0x555555593e90 "Exif", ds_orig=1126) at exif-data.c:871
#10 0x000055555556c86f in exif_loader_get_data (loader=0x555555593e40) at exif-loader.c:387
#11 0x000055555556002c in main (argc=2, argv=0x7fffffffdec8) at main.c:438
#12 0x00007ffff7c29d90 in __libc_start_call_main (main=main@entry=0x55555555f673 <main>, argc=argc@entry=2, argv=argv@entry=0x7fffffffdec8) at ../sysdeps/nptl/libc_start_call_main.h:58
#13 0x00007ffff7c29e40 in __libc_start_main_impl (main=0x55555555f673 <main>, argc=2, argv=0x7fffffffdec8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdeb8) at ../csu/libc-start.c:392
#14 0x000055555555d7a5 in _start ()
 
pwndbg> vmmap
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
             Start                End Perm     Size Offset File
    0x555555554000     0x55555555d000 r--p     9000      0 /home/cxing/fuzzing/libexif/dbg_install/bin/exif
    0x55555555d000     0x555555577000 r-xp    1a000   9000 /home/cxing/fuzzing/libexif/dbg_install/bin/exif
    0x555555577000     0x555555585000 r--p     e000  23000 /home/cxing/fuzzing/libexif/dbg_install/bin/exif
    0x555555585000     0x555555586000 r--p     1000  30000 /home/cxing/fuzzing/libexif/dbg_install/bin/exif
    0x555555586000     0x555555590000 rw-p     a000  31000 /home/cxing/fuzzing/libexif/dbg_install/bin/exif
    0x555555590000     0x5555555b2000 rw-p    22000      0 [heap]
    0x7ffff6e00000     0x7ffff7be7000 r--p   de7000      0 /usr/lib/locale/locale-archive
    0x7ffff7c00000     0x7ffff7c28000 r--p    28000      0 /usr/lib/x86_64-linux-gnu/libc.so.6
    0x7ffff7c28000     0x7ffff7dbd000 r-xp   195000  28000 /usr/lib/x86_64-linux-gnu/libc.so.6
    0x7ffff7dbd000     0x7ffff7e15000 r--p    58000 1bd000 /usr/lib/x86_64-linux-gnu/libc.so.6
    0x7ffff7e15000     0x7ffff7e19000 r--p     4000 214000 /usr/lib/x86_64-linux-gnu/libc.so.6
    0x7ffff7e19000     0x7ffff7e1b000 rw-p     2000 218000 /usr/lib/x86_64-linux-gnu/libc.so.6
    0x7ffff7e1b000     0x7ffff7e28000 rw-p     d000      0 [anon_7ffff7e1b]
    0x7ffff7eb1000     0x7ffff7eb4000 rw-p     3000      0 [anon_7ffff7eb1]
    0x7ffff7eb4000     0x7ffff7eb6000 r--p     2000      0 /usr/lib/x86_64-linux-gnu/libpopt.so.0.0.1
    0x7ffff7eb6000     0x7ffff7ebe000 r-xp     8000   2000 /usr/lib/x86_64-linux-gnu/libpopt.so.0.0.1
    0x7ffff7ebe000     0x7ffff7ec0000 r--p     2000   a000 /usr/lib/x86_64-linux-gnu/libpopt.so.0.0.1
    0x7ffff7ec0000     0x7ffff7ec1000 r--p     1000   b000 /usr/lib/x86_64-linux-gnu/libpopt.so.0.0.1
    0x7ffff7ec1000     0x7ffff7ec2000 rw-p     1000   c000 /usr/lib/x86_64-linux-gnu/libpopt.so.0.0.1
    0x7ffff7ec2000     0x7ffff7ed0000 r--p     e000      0 /usr/lib/x86_64-linux-gnu/libm.so.6
    0x7ffff7ed0000     0x7ffff7f4c000 r-xp    7c000   e000 /usr/lib/x86_64-linux-gnu/libm.so.6
    0x7ffff7f4c000     0x7ffff7fa7000 r--p    5b000  8a000 /usr/lib/x86_64-linux-gnu/libm.so.6
    0x7ffff7fa7000     0x7ffff7fa8000 r--p     1000  e4000 /usr/lib/x86_64-linux-gnu/libm.so.6
    0x7ffff7fa8000     0x7ffff7fa9000 rw-p     1000  e5000 /usr/lib/x86_64-linux-gnu/libm.so.6
    0x7ffff7fbb000     0x7ffff7fbd000 rw-p     2000      0 [anon_7ffff7fbb]
    0x7ffff7fbd000     0x7ffff7fc1000 r--p     4000      0 [vvar]
    0x7ffff7fc1000     0x7ffff7fc3000 r-xp     2000      0 [vdso]
    0x7ffff7fc3000     0x7ffff7fc5000 r--p     2000      0 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
    0x7ffff7fc5000     0x7ffff7fef000 r-xp    2a000   2000 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
    0x7ffff7fef000     0x7ffff7ffa000 r--p     b000  2c000 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
    0x7ffff7ffb000     0x7ffff7ffd000 r--p     2000  37000 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
    0x7ffff7ffd000     0x7ffff7fff000 rw-p     2000  39000 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
    0x7ffffffde000     0x7ffffffff000 rw-p    21000      0 [stack]
0xffffffffff600000 0xffffffffff601000 --xp     1000      0 [vsyscall]
pwndbg> x/16gx 0x5555555b1FF0
0x5555555b1ff0: 0x0000000000000000      0x0000000000000000
0x5555555b2000: Cannot access memory at address 0x5555555b2000
pwndbg>

exif_entry_fix调用exif_get_long代码如下。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
void
exif_entry_fix (ExifEntry *e)
{
    unsigned int i;
    ExifByteOrder o;
    ExifRational r;
    ExifSRational sr;
 
    if (!e || !e->priv) return;
 
    switch (e->tag) {
 
    /* These tags all need to be of format SHORT. */
    case xxx: // skip many case
    case EXIF_TAG_SHARPNESS:
        switch (e->format) {
        case EXIF_FORMAT_LONG:
            if (!e->parent || !e->parent->parent) break;
            o = exif_data_get_byte_order (e->parent->parent);
            for (i = 0; i < e->components; i++)
                exif_set_short (
                    e->data + i *
                    exif_format_get_size (
                    EXIF_FORMAT_SHORT), o,
                    (ExifShort) exif_get_long ( // here
                    e->data + i *
                    exif_format_get_size (
                    EXIF_FORMAT_LONG), o));
            e->format = EXIF_FORMAT_SHORT;
            e->size = e->components *
                exif_format_get_size (e->format);
            e->data = exif_entry_realloc (e, e->data, e->size);
            exif_entry_log (e, EXIF_LOG_CODE_DEBUG,
                _("Tag '%s' was of format '%s' (which is "
                "against specification) and has been "
                "changed to format '%s'."),
                exif_tag_get_name (e->tag),
                exif_format_get_name (EXIF_FORMAT_LONG),
                exif_format_get_name (EXIF_FORMAT_SHORT));
            break;
        case EXIF_FORMAT_SHORT:
        default:
            break;
        }
        break;
// .... skip

我们发现exif_get_long的第一个参数buf，是由这样一个算式决定的e->data + i* exif_format_get_size (EXIF_FORMAT_LONG)决定的。若e->data在堆的范围中是正常的那么便是后面加上的i *exif_format_get_size (EXIF_FORMAT_LONG)的值太大，以至于使得整个算式的结果太大越过堆的边界，所以我们关注到底是i的值太大还是exif_format_get_size (EXIF_FORMAT_LONG)返回的值太大，其中EXIF_FORMAT_LONG是一个等于4的常量，因此按理来说问题应该出在i上。我们在gdb中严重发现结果果然如此，如下框。
exif_entry_fix的代码有这样一句，e->size = e->components * exif_format_get_size (e->format);，从语义上理解，很自然的能够知道data的边界显然被size所规定，而该语句也说明正常情况下 e->components * var不应该超过size。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
In file: /home/cxing/fuzzing/libexif/libexif-0_6_14-release/libexif/exif-entry.c
   188                         for (i = 0; i < e->components; i++)
   189                                 exif_set_short (
   190                                         e->data + i *
   191                                         exif_format_get_size (
   192                                         EXIF_FORMAT_SHORT), o,
 ► 193                                         (ExifShort) exif_get_long (
   194                                         e->data + i *
   195                                         exif_format_get_size (
   196                                         EXIF_FORMAT_LONG), o));
   197                         e->format = EXIF_FORMAT_SHORT;
   198                         e->size = e->components *
──────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]───────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp 0x7fffffffd390 —▸ 0x7fffffffd490 —▸ 0x7fffffffd4b0 —▸ 0x7fffffffd4f0 —▸ 0x7fffffffd510 ◂— ...
01:0008│     0x7fffffffd398 —▸ 0x5555555965d0 ◂— 0x40000a401
02:0010│     0x7fffffffd3a0 —▸ 0x555555578690 ◂— 'No thumbnail but entries on thumbnail. These entries have been removed.'
03:0018│     0x7fffffffd3a8 ◂— 0x0
04:0020│     0x7fffffffd3b0 ◂— 0x100000000
05:0028│     0x7fffffffd3b8 —▸ 0x555555593de0 ◂— 0x8
06:0030│ r8  0x7fffffffd3c0 ◂— 0x3000000020 /* ' ' */
07:0038│     0x7fffffffd3c8 ◂— 0x0
────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────────────────────────────────────────────────────────
 ► f 0   0x55555556617b exif_entry_fix+460
   f 1   0x55555556288f fix_func+32
   f 2   0x555555562726 exif_content_foreach_entry+83
   f 3   0x5555555628eb exif_content_fix+89
   f 4   0x555555565a22 fix_func+194
   f 5   0x5555555655b6 exif_data_foreach_content+74
   f 6   0x555555565a51 exif_data_fix+43
   f 7   0x555555565008 exif_data_load_data+1926
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> bt
#0  exif_entry_fix (e=0x5555555965d0) at exif-entry.c:193
#1  0x000055555556288f in fix_func (e=0x5555555965d0, data=0x0) at exif-content.c:231
#2  0x0000555555562726 in exif_content_foreach_entry (content=0x555555594450, func=0x55555556286f <fix_func>, data=0x0) at exif-content.c:200
#3  0x00005555555628eb in exif_content_fix (c=0x555555594450) at exif-content.c:247
#4  0x0000555555565a22 in fix_func (c=0x555555594450, data=0x0) at exif-data.c:1169
#5  0x00005555555655b6 in exif_data_foreach_content (data=0x555555594320, func=0x555555565960 <fix_func>, user_data=0x0) at exif-data.c:1031
#6  0x0000555555565a51 in exif_data_fix (d=0x555555594320) at exif-data.c:1176
#7  0x0000555555565008 in exif_data_load_data (data=0x555555594320, d_orig=0x555555593e90 "Exif", ds_orig=1126) at exif-data.c:871
#8  0x000055555556c86f in exif_loader_get_data (loader=0x555555593e40) at exif-loader.c:387
#9  0x000055555556002c in main (argc=2, argv=0x7fffffffdeb8) at main.c:438
#10 0x00007ffff7c29d90 in __libc_start_call_main (main=main@entry=0x55555555f673 <main>, argc=argc@entry=2, argv=argv@entry=0x7fffffffdeb8) at ../sysdeps/nptl/libc_start_call_main.h:58
#11 0x00007ffff7c29e40 in __libc_start_main_impl (main=0x55555555f673 <main>, argc=2, argv=0x7fffffffdeb8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdea8) at ../csu/libc-start.c:392
#12 0x000055555555d7a5 in _start ()
pwndbg> p e->data
$6 = (unsigned char *) 0x555555596630 "\033"
pwndbg> p e->components
$7 = 2147483899
pwndbg> python-interactive
>>> hex(2147483899)
'0x800000fb'
>>>
pwndbg> p *e
$1 = {
  tag = EXIF_TAG_CUSTOM_RENDERED,
  format = EXIF_FORMAT_LONG,
  components = 2147483899,
  data = 0x555555596630 "\033",
  size = 1004,
  parent = 0x555555594450,
  priv = 0x555555596610
}

我们直接对e->components下内存断点追踪，我们追踪到如下这里。下面第164行entry->components = exif_get_long (d + offset + 4, data->priv->order);就是玩我们追踪的components，我们查阅其值，显然是已经写入了过大的值。
显然问题出在exif_get_long (d + offset + 4, data->priv->order)上，我们查看d发现其就是图像文件中exif部分的data部分。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
─────────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]─────────────────────────────────────────────────────────────────────────────────────
 ► 0x555555562d92 <exif_data_load_data_entry+158>    mov    rax, qword ptr [rbp - 0x20]
   0x555555562d96 <exif_data_load_data_entry+162>    mov    eax, dword ptr [rax]
   0x555555562d98 <exif_data_load_data_entry+164>    mov    edi, eax
   0x555555562d9a <exif_data_load_data_entry+166>    call   exif_tag_get_name                <exif_tag_get_name>
 
   0x555555562d9f <exif_data_load_data_entry+171>    mov    rdx, rax
   0x555555562da2 <exif_data_load_data_entry+174>    mov    rax, qword ptr [rbp - 0x20]
   0x555555562da6 <exif_data_load_data_entry+178>    mov    ecx, dword ptr [rax]
   0x555555562da8 <exif_data_load_data_entry+180>    mov    rax, qword ptr [rbp - 0x18]
   0x555555562dac <exif_data_load_data_entry+184>    mov    rax, qword ptr [rax + 0x38]
   0x555555562db0 <exif_data_load_data_entry+188>    mov    rax, qword ptr [rax + 0x10]
   0x555555562db4 <exif_data_load_data_entry+192>    mov    r9, rdx
──────────────────────────────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]───────────────────────────────────────────────────────────────────────────────────────────────
In file: /home/cxing/fuzzing/libexif/libexif-0_6_14-release/libexif/exif-data.c
   161
   162         entry->tag        = exif_get_short (d + offset + 0, data->priv->order);
   163         entry->format     = exif_get_short (d + offset + 2, data->priv->order);
   164         entry->components = exif_get_long  (d + offset + 4, data->priv->order);
   165
 ► 166         exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
   167                   "Loading entry 0x%x ('%s')...", entry->tag,
   168                   exif_tag_get_name (entry->tag));
   169
   170         /*
   171          * Size? If bigger than 4 bytes, the actual data is not
──────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]───────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp 0x7fffffffd440 ◂— 0x46000000274
01:0008│     0x7fffffffd448 —▸ 0x555555593e96 ◂— 0x80000002a004d4d /* 'MM' */
02:0010│     0x7fffffffd450 —▸ 0x5555555965d0 ◂— 0x40000a401
03:0018│     0x7fffffffd458 —▸ 0x555555594320 —▸ 0x5555555943b0 —▸ 0x555555594820 —▸ 0x555555594540 ◂— ...
04:0020│     0x7fffffffd460 ◂— 0xffffd4c0
05:0028│     0x7fffffffd468 —▸ 0x5555555965d0 ◂— 0x40000a401
06:0030│ rbp 0x7fffffffd470 —▸ 0x7fffffffd4c0 —▸ 0x7fffffffd510 —▸ 0x7fffffffd570 —▸ 0x7fffffffd5a0 ◂— ...
07:0038│     0x7fffffffd478 —▸ 0x555555563a48 (exif_data_load_data_content+1642) ◂— test eax, eax
────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────────────────────────────────────────────────────────
 ► f 0   0x555555562d92 exif_data_load_data_entry+158
   f 1   0x555555563a48 exif_data_load_data_content+1642
   f 2   0x555555563706 exif_data_load_data_content+808
   f 3   0x555555564d8a exif_data_load_data+1288
   f 4   0x55555556c86f exif_loader_get_data+103
   f 5   0x55555556002c main+2489
   f 6   0x7ffff7c29d90 __libc_start_call_main+128
   f 7   0x7ffff7c29e40 __libc_start_main+128
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> p entry->components
$12 = 2147483899
pwndbg> x/16gs d
warning: Unable to display strings with size 'g', using 'b' instead.
0x555555593e96: "MM"
0x555555593e99: "*"
0x555555593e9b: ""
0x555555593e9c: ""
0x555555593e9d: "\b"
0x555555593e9f: "\f\001\017"
0x555555593ea3: "\002"
0x555555593ea5: ""
0x555555593ea6: ""
0x555555593ea7: "\t"
0x555555593ea9: ""
0x555555593eaa: ""
0x555555593eab: "\236\001\020"
0x555555593eaf: "\002\362\377"
0x555555593eb3: "\020"
0x555555593eb5: ""

下图中crash_2 Exif...MM即d所指向的部分。
图片描述
![image.png] 图片描述
显然由于其没有对Exif data中字段严格的校验，使得我们可以通过精心构造的exif data指定一个巨大的components，使得程序在读写data时发生越界，而data本身在堆上也就出现了堆溢出，也就是说可能存在堆上的越界读写行为，将有可能造成远程代码执行。具体的，我们将不再分析。

CVE-2009-3895 修复建议

我们知道由于对 exif结构中字段的解析没有严格按照去语义进行，即通过component读取data时不能超过size指定的边界，因此应该在写入Components时检测components的值，若存在可能超过size边界，则立刻抛出异常，终止解析跳过该部分。具体的修复代码我个人就不动手了，相信看完我的分析对诸位读者来说已经是小菜一碟了。

CVE-2012-2836 crash分析

先来看一下crash_1的堆栈回溯。我们通用可以看到堆栈回溯中出现了这样的提醒buf=0x555655593e93 <error: Cannot access memory at address 0x555655593e93>，这显然又是堆空间发生了越界读写现象，读写到了非法内存地址导致程序崩溃。我们从函数参数都正常的exif_data_load_data开始分析。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
cxing@cxing-virtual-machine:~/fuzzing/libexif/dbg_install/bin$ gdb --args ./exif ../../crash_1
 
------- tip of the day (disable with set show-tips off) -------
Pwndbg resolves kernel memory maps by parsing page tables (default) or via monitor info mem QEMU gdbstub command (use set kernel-vmmap-via-page-tables off for that)
pwndbg> r
Starting program: /home/cxing/fuzzing/libexif/dbg_install/bin/exif ../../crash_1
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
 
Program received signal SIGSEGV, Segmentation fault.
0x000055555556de54 in exif_get_sshort (buf=0x555655593e93 <error: Cannot access memory at address 0x555655593e93>, order=EXIF_BYTE_ORDER_MOTOROLA) at exif-utils.c:92
92                      return ((buf[0] << 8) | buf[1]);
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]────────────────────────────────────────────────────────────────────────────
*RAX  0x555655593e93
 RBX  0x0
*RCX  0x100000003
 RDX  0x0
*RDI  0x555655593e93
 RSI  0x0
*R8   0xfffffffd
 R9   0x0
*R10  0x55555555ee99 (log_func_exit) ◂— endbr64
*R11  0x7ffff7e19ce0 (main_arena+96) —▸ 0x555555595990 ◂— 0x0
*R12  0x7fffffffdeb8 —▸ 0x7fffffffe1d2 ◂— '/home/cxing/fuzzing/libexif/dbg_install/bin/exif'
*R13  0x55555555f673 (main) ◂— endbr64
*R14  0x555555585bd8 (__do_global_dtors_aux_fini_array_entry) —▸ 0x55555555d820 (__do_global_dtors_aux) ◂— endbr64
*R15  0x7ffff7ffd040 (_rtld_global) —▸ 0x7ffff7ffe2e0 —▸ 0x555555554000 ◂— 0x10102464c457f
*RBP  0x7fffffffd4f0 —▸ 0x7fffffffd510 —▸ 0x7fffffffd570 —▸ 0x7fffffffd5a0 —▸ 0x7fffffffdda0 ◂— ...
*RSP  0x7fffffffd4f0 —▸ 0x7fffffffd510 —▸ 0x7fffffffd570 —▸ 0x7fffffffd5a0 —▸ 0x7fffffffdda0 ◂— ...
*RIP  0x55555556de54 (exif_get_sshort+47) ◂— movzx eax, byte ptr [rax]
─────────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]─────────────────────────────────────────────────────────────────────────────────────
 ► 0x55555556de54 <exif_get_sshort+47>     movzx  eax, byte ptr [rax]
   0x55555556de57 <exif_get_sshort+50>     movzx  eax, al
   0x55555556de5a <exif_get_sshort+53>     shl    eax, 8
   0x55555556de5d <exif_get_sshort+56>     mov    edx, eax
   0x55555556de5f <exif_get_sshort+58>     mov    rax, qword ptr [rbp - 8]
   0x55555556de63 <exif_get_sshort+62>     add    rax, 1
   0x55555556de67 <exif_get_sshort+66>     movzx  eax, byte ptr [rax]
   0x55555556de6a <exif_get_sshort+69>     movzx  eax, al
   0x55555556de6d <exif_get_sshort+72>     or     eax, edx
   0x55555556de6f <exif_get_sshort+74>     jmp    exif_get_sshort+114                <exif_get_sshort+114>
    ↓
   0x55555556de97 <exif_get_sshort+114>    pop    rbp
──────────────────────────────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]───────────────────────────────────────────────────────────────────────────────────────────────
In file: /home/cxing/fuzzing/libexif/libexif-0_6_14-release/libexif/exif-utils.c
   87 exif_get_sshort (const unsigned char *buf, ExifByteOrder order)
   88 {
   89         if (!buf) return 0;
   90         switch (order) {
   91         case EXIF_BYTE_ORDER_MOTOROLA:
 ► 92                 return ((buf[0] << 8) | buf[1]);
   93         case EXIF_BYTE_ORDER_INTEL:
   94                 return ((buf[1] << 8) | buf[0]);
   95         }
   96
   97         /* Won't be reached */
──────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]───────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rbp rsp 0x7fffffffd4f0 —▸ 0x7fffffffd510 —▸ 0x7fffffffd570 —▸ 0x7fffffffd5a0 —▸ 0x7fffffffdda0 ◂— ...
01:0008│         0x7fffffffd4f8 —▸ 0x55555556debd (exif_get_short+36) ◂— leave
02:0010│         0x7fffffffd500 ◂— 0x5555f673
03:0018│         0x7fffffffd508 ◂— 0x555655593e93
04:0020│         0x7fffffffd510 —▸ 0x7fffffffd570 —▸ 0x7fffffffd5a0 —▸ 0x7fffffffdda0 ◂— 0x2
05:0028│         0x7fffffffd518 —▸ 0x555555564dbb (exif_data_load_data+1337) ◂— mov word ptr [rbp - 0x2a], ax
06:0030│         0x7fffffffd520 —▸ 0x7fffffffd540 —▸ 0x7fffffffd570 —▸ 0x7fffffffd5a0 —▸ 0x7fffffffdda0 ◂— ...
07:0038│         0x7fffffffd528 ◂— 0x338555627bd
────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────────────────────────────────────────────────────────
 ► f 0   0x55555556de54 exif_get_sshort+47
   f 1   0x55555556debd exif_get_short+36
   f 2   0x555555564dbb exif_data_load_data+1337
   f 3   0x55555556c86f exif_loader_get_data+103
   f 4   0x55555556002c main+2489
   f 5   0x7ffff7c29d90 __libc_start_call_main+128
   f 6   0x7ffff7c29e40 __libc_start_main+128
   f 7   0x55555555d7a5 _start+37
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> bt
#0  0x000055555556de54 in exif_get_sshort (buf=0x555655593e93 <error: Cannot access memory at address 0x555655593e93>, order=EXIF_BYTE_ORDER_MOTOROLA) at exif-utils.c:92
#1  0x000055555556debd in exif_get_short (buf=0x555655593e93 <error: Cannot access memory at address 0x555655593e93>, order=EXIF_BYTE_ORDER_MOTOROLA) at exif-utils.c:104
#2  0x0000555555564dbb in exif_data_load_data (data=0x555555594320, d_orig=0x555555593e90 "Exif", ds_orig=824) at exif-data.c:819
#3  0x000055555556c86f in exif_loader_get_data (loader=0x555555593e40) at exif-loader.c:387
#4  0x000055555556002c in main (argc=2, argv=0x7fffffffdeb8) at main.c:438
#5  0x00007ffff7c29d90 in __libc_start_call_main (main=main@entry=0x55555555f673 <main>, argc=argc@entry=2, argv=argv@entry=0x7fffffffdeb8) at ../sysdeps/nptl/libc_start_call_main.h:58
#6  0x00007ffff7c29e40 in __libc_start_main_impl (main=0x55555555f673 <main>, argc=2, argv=0x7fffffffdeb8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdea8) at ../csu/libc-start.c:392
#7  0x000055555555d7a5 in _start ()
pwndbg>

显然在819行n = exif_get_short (d + 6 + offset, data->priv->order);语句执行完毕后，其中第一个参数指向了非常内存地址，即d + 6 + offset这算式存在问题。从gdb中可以看见，d是指向exif结构的基地址，是正常的那么问题就出来了offset上，我们看到他的值为4294967293太大了，显然是不正常的。我们需要寻找offset赋值处。
我们在gdb中向上翻阅代码l -20发现这样一条语句offset = exif_get_long (d + 10, data->priv->order);，这时从d + 10处取4字节转为long类型赋值给offset。我们还发现了对offset字段的检查offset + 6 + 2 > ds。注意offset是uint32_t类型，也就是说我们只需要将offset + 8溢出为0，那么必然可以通过检查，所以offset的值在[-8, 0)这个区间，必然发生溢出，通过检查。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
In file: /home/cxing/fuzzing/libexif/libexif-0_6_14-release/libexif/exif-data.c
   814
   815         /* IFD 1 offset */
   816         if (offset + 6 + 2 > ds) {
   817                 return;
   818         }
 ► 819         n = exif_get_short (d + 6 + offset, data->priv->order);
   820         if (offset + 6 + 2 + 12 * n + 4 > ds) {
   821                 return;
   822         }
   823         offset = exif_get_long (d + 6 + offset + 2 + 12 * n, data->priv->order);
   824         if (offset) {
──────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]───────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp 0x7fffffffd520 —▸ 0x7fffffffd540 —▸ 0x7fffffffd570 —▸ 0x7fffffffd5a0 —▸ 0x7fffffffdda0 ◂— ...
01:0008│     0x7fffffffd528 ◂— 0x338555627bd
02:0010│     0x7fffffffd530 —▸ 0x555555593e90 ◂— 0x4d4d000066697845 /* 'Exif' */
03:0018│     0x7fffffffd538 —▸ 0x555555594320 —▸ 0x5555555943b0 ◂— 0x0
04:0020│     0x7fffffffd540 —▸ 0x7fffffffd570 —▸ 0x7fffffffd5a0 —▸ 0x7fffffffdda0 ◂— 0x2
05:0028│     0x7fffffffd548 ◂— 0x555500000338
06:0030│     0x7fffffffd550 ◂— 0xfffffffd55593de0
07:0038│     0x7fffffffd558 —▸ 0x555555593e90 ◂— 0x4d4d000066697845 /* 'Exif' */
────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────────────────────────────────────────────────────────
 ► f 0   0x555555564d99 exif_data_load_data+1303
   f 1   0x55555556c86f exif_loader_get_data+103
   f 2   0x55555556002c main+2489
   f 3   0x7ffff7c29d90 __libc_start_call_main+128
   f 4   0x7ffff7c29e40 __libc_start_main+128
   f 5   0x55555555d7a5 _start+37
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> p d
$3 = (const unsigned char *) 0x555555593e90 "Exif"
pwndbg> p offset
$2 = 4294967293
pwndbg> bt
pwndbg> l -20
804             if (exif_get_short (d + 8, data->priv->order) != 0x002a)
805                     return;
806
807             /* IFD 0 offset */
808             offset = exif_get_long (d + 10, data->priv->order);
809             exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
810                       "IFD 0 at %i.", (int) offset);
811
812             /* Parse the actual exif data (usually offset 14 from start) */
813             exif_data_load_data_content (data, EXIF_IFD_0, d + 6, ds - 6, offset, 0);
pwndbg>

那么到此为止，我们分析完了两个CVE的成因。

CVE-2012-2836 修复建议

我们只需要检查offset的值是否在[-8, 0)这个溢出区间即可，包括后续又几个对offset的检查，我们可以适当扩大一些，一个字节即[-255,0)区间的检查。

尾声

在gdb上调试分析的体验比Windows上差太多了，没有像x64dbg和od这样方便的图形化工具，还是有些麻烦的。


[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！

最后于 2023-4-28 17:59 被Cx1ng编辑 ，原因：
收藏
免费 ・2
支持
分享
最新回复 (0)
游客
登录 | 注册 方可回帖
回帖 表情 雪币赚取及消费
高级回复
返回
//