heap-buffer-overflow in dex_parse in virustotal/yara

Valid

Reported on

Jun 11th 2022

Description

There exists a heap based out of bounds read vulnerability in dex_parse

      set_integer(
          yr_le16toh(map_item->type),
          dex->object,
          "map_list.map_item[%i].type",
          i);

Reproduction

Build the fuzz target with address sanitizer enabled + optional libfuzzer and run the test case from here

$ git rev-parse HEAD
3484fcb60b746eace99999c1c9541a3bad46ad0a
$ export CFLAGS="-g -O0 -fsanitize=address,fuzzer"; export CXXFLAGS="-g -O0 -fsanitize=address,fuzzer"; export CC=$(which clang-10); export CXX=$(which clang++-10)
$ ./configure --enable-dex --without-crypto
$ make -j 8
$ clang++-10 -g -fsanitize=address,fuzzer -std=c++11 -I . -I libyara/include ./tests/oss-fuzz/dex_fuzzer.cc -o dexf ./libyara/.libs/libyara.a
$ ./dexf /tmp/0c34834e3bbbb5d51c50d690407bde56361615c6
INFO: Seed: 2959956394
INFO: Loaded 1 modules   (9 inline 8-bit counters): 9 [0x9af340, 0x9af349),
INFO: Loaded 1 PC tables (9 PCs): 9 [0x74ad18,0x74ada8),
./dexf: Running 1 inputs 1 time(s) each.
Running: /tmp/minout-3
=================================================================
==25296==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000000744 at pc 0x00000062d83d bp 0x7ffe3b0a1a30 sp 0x7ffe3b0a1a28
READ of size 2 at 0x612000000744 thread T0
    #0 0x62d83c in dex_parse /home/sudhakar/fuzz/yara/libyara/modules/dex/dex.c:1127:7
    #1 0x632c0c in dex__load /home/sudhakar/fuzz/yara/libyara/modules/dex/dex.c:1483:7
    #2 0x56eb3e in yr_modules_load /home/sudhakar/fuzz/yara/libyara/modules.c:158:16
    #3 0x68a716 in yr_execute_code /home/sudhakar/fuzz/yara/libyara/exec.c:1735:16
    #4 0x57f27b in yr_scanner_scan_mem_blocks /home/sudhakar/fuzz/yara/libyara/scanner.c:515:3
    #5 0x580edb in yr_scanner_scan_mem /home/sudhakar/fuzz/yara/libyara/scanner.c:659:16
    #6 0x579c8f in yr_rules_scan_mem /home/sudhakar/fuzz/yara/libyara/rules.c:223:12
    #7 0x5507e8 in LLVMFuzzerTestOneInput /home/sudhakar/fuzz/yara/./tests/oss-fuzz/dex_fuzzer.cc:43:3
    #8 0x458821 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/sudhakar/fuzz/yara/dexf+0x458821)
    #9 0x443f92 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/sudhakar/fuzz/yara/dexf+0x443f92)
    #10 0x449a46 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/sudhakar/fuzz/yara/dexf+0x449a46)
    #11 0x472702 in main (/home/sudhakar/fuzz/yara/dexf+0x472702)
    #12 0x7f1277222c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #13 0x41e659 in _start (/home/sudhakar/fuzz/yara/dexf+0x41e659)

0x612000000744 is located 0 bytes to the right of 260-byte region [0x612000000640,0x612000000744)
allocated by thread T0 here:
    #0 0x51e38d in malloc (/home/sudhakar/fuzz/yara/dexf+0x51e38d)
    #1 0x432a47 in operator new(unsigned long) (/home/sudhakar/fuzz/yara/dexf+0x432a47)
    #2 0x443f92 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/sudhakar/fuzz/yara/dexf+0x443f92)
    #3 0x449a46 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/sudhakar/fuzz/yara/dexf+0x449a46)
    #4 0x472702 in main (/home/sudhakar/fuzz/yara/dexf+0x472702)
    #5 0x7f1277222c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/sudhakar/fuzz/yara/libyara/modules/dex/dex.c:1127:7 in dex_parse
Shadow bytes around the buggy address:
  0x0c247fff8090: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fff80a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fff80b0: 00 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa
  0x0c247fff80c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fff80d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c247fff80e0: 00 00 00 00 00 00 00 00[04]fa fa fa fa fa fa fa
  0x0c247fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff8110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff8130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==25296==ABORTING

This output is from a fuzzing session that included afl++ and libfuzzer working with a shared corpus. I'll have to work on the analysis but seeing that its only an out of bounds read - doesn't feel worth it.

Impact

The impact is pretty low - this can only read out of the bounds of an array, so maybe used to leak some memory and then used with another primitive to make it useful.

We are processing your report and will contact the virustotal/yara team within 24 hours. a year ago