{"id":526,"date":"2016-09-11T12:26:05","date_gmt":"2016-09-11T10:26:05","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=526"},"modified":"2016-12-01T15:42:27","modified_gmt":"2016-12-01T13:42:27","slug":"libarchive-bsdtar-use-after-free-in-bid_entry-archive_read_support_format_mtree-c","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2016\/09\/11\/libarchive-bsdtar-use-after-free-in-bid_entry-archive_read_support_format_mtree-c\/","title":{"rendered":"libarchive: bsdtar use-after-free in bid_entry (archive_read_support_format_mtree.c)"},"content":{"rendered":"

Description<\/strong>:
\nlibarchive<\/a> is a multi-format archive and compression library.<\/p>\n

After it got fuzzed by hanno and some other people (1<\/a> 2<\/a> 3<\/a>)I decided to fuzz it too.<\/p>\n

A crafted file causes an use-after-free in the bid_entry function in the mtree parser.<\/p>\n

This bug seems to be similar to THIS<\/a> use-after-free but in this case ASan reports that happens in the bid_entry function instead of detect_form.<\/p>\n

The complete ASan output:<\/p>\n

# bsdtar -t -f $FILE\r\n==25892==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f2eec8eb31b at pc 0x7f2eec2b9bb6 bp 0x7ffc198b3b30 sp 0x7ffc198b3b28\r\nREAD of size 1 at 0x7f2eec8eb31b thread T0\r\n    #0 0x7f2eec2b9bb5 in bid_entry \/var\/tmp\/portage\/app-arch\/libarchive-3.2.1-r3\/work\/libarchive-3.2.1\/libarchive\/archive_read_support_format_mtree.c:567:7\r\n    #1 0x7f2eec2b9bb5 in detect_form \/var\/tmp\/portage\/app-arch\/libarchive-3.2.1-r3\/work\/libarchive-3.2.1\/libarchive\/archive_read_support_format_mtree.c:676\r\n    #2 0x7f2eec17f18b in choose_format \/var\/tmp\/portage\/app-arch\/libarchive-3.2.1-r3\/work\/libarchive-3.2.1\/libarchive\/archive_read.c:712:10\r\n    #3 0x7f2eec17f18b in archive_read_open1 \/var\/tmp\/portage\/app-arch\/libarchive-3.2.1-r3\/work\/libarchive-3.2.1\/libarchive\/archive_read.c:529\r\n    #4 0x7f2eec1b6f1f in archive_read_open_filename \/var\/tmp\/portage\/app-arch\/libarchive-3.2.1-r3\/work\/libarchive-3.2.1\/libarchive\/archive_read_open_filename.c:109:9\r\n    #5 0x501f66 in read_archive \/var\/tmp\/portage\/app-arch\/libarchive-3.2.1-r3\/work\/libarchive-3.2.1\/tar\/read.c:223:6\r\n    #6 0x501473 in tar_mode_t \/var\/tmp\/portage\/app-arch\/libarchive-3.2.1-r3\/work\/libarchive-3.2.1\/tar\/read.c:94:2\r\n    #7 0x4f8929 in main \/var\/tmp\/portage\/app-arch\/libarchive-3.2.1-r3\/work\/libarchive-3.2.1\/tar\/bsdtar.c:803:3\r\n    #8 0x7f2eeb1f261f in __libc_start_main \/var\/tmp\/portage\/sys-libs\/glibc-2.22-r4\/work\/glibc-2.22\/csu\/libc-start.c:289\r\n    #9 0x41b778 in _init (\/usr\/bin\/bsdtar+0x41b778)\r\n\r\n0x7f2eec8eb31b is located 27419 bytes inside of 131072-byte region [0x7f2eec8e4800,0x7f2eec904800)\r\nfreed by thread T0 here:\r\n    #0 0x4c29c0 in free \/var\/tmp\/portage\/sys-devel\/llvm-3.8.0-r3\/work\/llvm-3.8.0.src\/projects\/compiler-rt\/lib\/asan\/asan_malloc_linux.cc:38\r\n    #1 0x7f2eec186c68 in __archive_read_filter_ahead \/var\/tmp\/portage\/app-arch\/libarchive-3.2.1-r3\/work\/libarchive-3.2.1\/libarchive\/archive_read.c:1450:5\r\n\r\npreviously allocated by thread T0 here:\r\n    #0 0x4c2cc8 in malloc \/var\/tmp\/portage\/sys-devel\/llvm-3.8.0-r3\/work\/llvm-3.8.0.src\/projects\/compiler-rt\/lib\/asan\/asan_malloc_linux.cc:52\r\n    #1 0x7f2eec186bca in __archive_read_filter_ahead \/var\/tmp\/portage\/app-arch\/libarchive-3.2.1-r3\/work\/libarchive-3.2.1\/libarchive\/archive_read.c:1436:17\r\n\r\nSUMMARY: AddressSanitizer: heap-use-after-free \/var\/tmp\/portage\/app-arch\/libarchive-3.2.1-r3\/work\/libarchive-3.2.1\/libarchive\/archive_read_support_format_mtree.c:567:7 in bid_entry\r\nShadow bytes around the buggy address:\r\n  0x0fe65d915610: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n  0x0fe65d915620: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n  0x0fe65d915630: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n  0x0fe65d915640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n  0x0fe65d915650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n=>0x0fe65d915660: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd\r\n  0x0fe65d915670: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n  0x0fe65d915680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n  0x0fe65d915690: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n  0x0fe65d9156a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n  0x0fe65d9156b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:       fa\r\n  Heap right redzone:      fb\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack partial redzone:   f4\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  Array cookie:            ac\r\n  Intra object redzone:    bb\r\n  ASan internal:           fe\r\n  Left alloca redzone:     ca\r\n  Right alloca redzone:    cb\r\n==25892==ABORTING\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n3.2.1<\/p>\n
Fixed version:<\/strong>
\n3.2.2<\/p>\n
Commit fix:<\/strong>
\nhttps:\/\/github.com\/libarchive\/libarchive\/commit\/eec077f52bfa2d3f7103b4b74d52572ba8a15aca<\/a><\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nCVE-2016-8688<\/p>\n
Timeline:<\/strong>
\n2016-08-11: bug discovered
\n2016-08-11: bug reported to upstream
\n2016-09-11: blog post about the issue
\n2016-09-19: upstream released a patch
\n2016-10-16: CVE Assigned
\n2016-10-24: Upstream released 3.2.2<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
libarchive: bsdtar use-after-free in bid_entry (archive_read_support_format_mtree.c)<\/a><\/p><\/blockquote>\n