[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-18:12.elf
Lena at lena.kiev.ua
Lena at lena.kiev.ua
Sat Oct 6 17:35:38 UTC 2018
> Insufficient validation was performed in the ELF header parser, and malformed
> or otherwise invalid ELF binaries were not rejected as they should be.
What is invalid in the /usr/local/share/google-earth/googleearth-bin
binary of the port google-earth-7.1.5.1557,3 ?
FreeBSD 11.2-RELEASE-p4 Sep 27 GENERIC i386, the binary:
https://drive.google.com/file/d/1SgHk8ijSp2F9UcQGlx44psT832TdIEL0/view
~ $ googleearth
Invalid PT_INTERP
exec: ./googleearth-bin: Exec format error
~ $ readelf --program-headers /usr/local/share/google-earth/googleearth-bin
Elf file type is EXEC (Executable file)
Entry point 0x8048650
There are 8 program headers, starting at offset 52
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR 0x000034 0x08048034 0x08048034 0x00100 0x00100 R E 0x4
INTERP 0x000134 0x08048134 0x08048134 0x00011 0x00011 R 0x1
[Requesting program interpreter: /lib/ld-linux.so.2]
LOAD 0x000000 0x08048000 0x08048000 0x007f4 0x007f4 R E 0x1000
LOAD 0x000e74 0x08049e74 0x08049e74 0x001a0 0x001a8 RW 0x1000
DYNAMIC 0x000e88 0x08049e88 0x08049e88 0x00168 0x00168 RW 0x4
NOTE 0x000148 0x08048148 0x08048148 0x00044 0x00044 R 0x4
GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0x4
GNU_RELRO 0x000e74 0x08049e74 0x08049e74 0x0018c 0x0018c R 0x1
Section to Segment mapping:
Segment Sections...
00
01 .interp
02 .interp .note.ABI-tag .note.gnu.build-id .hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .plt .text .fini .rodata .eh_frame
03 .ctors .dtors .jcr .dynamic .got .got.plt .data .bss
04 .dynamic
05 .note.ABI-tag .note.gnu.build-id
06
07 .ctors .dtors .jcr .dynamic .got
~ $ ls -l /usr/local/share/google-earth/googleearth-bin
-r-xr-xr-x 1 root wheel 5452 Sep 10 2016 /usr/local/share/google-earth/googleearth-bin
~ $ hd /usr/local/share/google-earth/googleearth-bin | less
00000000 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 |.ELF............|
00000010 02 00 03 00 01 00 00 00 50 86 04 08 34 00 00 00 |........P├..4...|
00000020 14 11 00 00 00 00 00 00 34 00 20 00 08 00 28 00 |........4. ...(.|
00000030 1b 00 1a 00 06 00 00 00 34 00 00 00 34 80 04 08 |........4...4─..|
00000040 34 80 04 08 00 01 00 00 00 01 00 00 05 00 00 00 |4─..............|
00000050 04 00 00 00 03 00 00 00 34 01 00 00 34 81 04 08 |........4...4│..|
00000060 34 81 04 08 11 00 00 00 11 00 00 00 04 00 00 00 |4│..............|
00000070 01 00 00 00 01 00 00 00 00 00 00 00 00 80 04 08 |.............─..|
00000080 00 80 04 08 f4 07 00 00 f4 07 00 00 05 00 00 00 |.─..Т...Т.......|
00000090 00 10 00 00 01 00 00 00 74 0e 00 00 74 9e 04 08 |........t...t·..|
000000a0 74 9e 04 08 a0 01 00 00 a8 01 00 00 06 00 00 00 |t·..═...╗.......|
000000b0 00 10 00 00 02 00 00 00 88 0e 00 00 88 9e 04 08 |........┬...┬·..|
000000c0 88 9e 04 08 68 01 00 00 68 01 00 00 06 00 00 00 |┬·..h...h.......|
000000d0 04 00 00 00 04 00 00 00 48 01 00 00 48 81 04 08 |........H...H│..|
000000e0 48 81 04 08 44 00 00 00 44 00 00 00 04 00 00 00 |H│..D...D.......|
000000f0 04 00 00 00 51 e5 74 64 00 00 00 00 00 00 00 00 |....QЕtd........|
00000100 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 |................|
00000110 04 00 00 00 52 e5 74 64 74 0e 00 00 74 9e 04 08 |....RЕtdt...t·..|
00000120 74 9e 04 08 8c 01 00 00 8c 01 00 00 04 00 00 00 |t·..▄...▄.......|
00000130 01 00 00 00 2f 6c 69 62 2f 6c 64 2d 6c 69 6e 75 |..../lib/ld-linu|
00000140 78 2e 73 6f 2e 32 00 00 04 00 00 00 10 00 00 00 |x.so.2..........|
00000150 01 00 00 00 47 4e 55 00 00 00 00 00 02 00 00 00 |....GNU.........|
00000160 06 00 00 00 0f 00 00 00 04 00 00 00 14 00 00 00 |................|
00000170 03 00 00 00 47 4e 55 00 ec f1 2d c9 13 9e 39 77 |....GNU.ЛЯ-и.·9w|
00000180 54 45 91 3d e6 c5 0b ae 90 8a 6d 1a 03 00 00 00 |TE▒=Фе.╝░┼m.....|
00000190 0b 00 00 00 09 00 00 00 04 00 00 00 0a 00 00 00 |................|
000001a0 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 |................|
000001b0 02 00 00 00 00 00 00 00 05 00 00 00 06 00 00 00 |................|
000001c0 07 00 00 00 08 00 00 00 03 00 00 00 00 00 00 00 |................|
The commit:
https://lists.freebsd.org/pipermail/svn-src-all/2018-September/170051.html
case PT_INTERP:
/* Path to interpreter */
- if (phdr[i].p_filesz > MAXPATHLEN) {
+ if (phdr[i].p_filesz < 2 ||
+ phdr[i].p_filesz > MAXPATHLEN) {
uprintf("Invalid PT_INTERP\n");
error = ENOEXEC;
interp = __DECONST(char *, imgp->image_header) +
phdr[i].p_offset;
+ if (interp[interp_name_len - 1] != '\0') {
+ uprintf("Invalid PT_INTERP\n");
+ error = ENOEXEC;
More information about the freebsd-security
mailing list