Bug #10957
Updated by nobu (Nobuyoshi Nakada) about 9 years ago
Built ruby 2.3.0dev (2015-03-07 trunk 49885) [x86_64-linux] from git source earlier this evening. This bug was found with american fuzzy lop (http://lcamtuf.coredump.cx/afl) and was compiled as follows: CC=afl-gcc ./configure && AFL_HARDEN=1 make -j8 && make install Valgrind: ~~~ ==41211== Invalid write of size 1 ==41211== at 0x827873: reserve_stack (thread_pthread.c:684) ==41211== by 0x842871: ruby_init_stack (thread_pthread.c:713) ==41211== by 0x1337E8: main (main.c:34) ==41211== Address 0x7fe8010e0 is on thread 1's stack ==41211== ==41211== Stack overflow in thread 1: can't grow stack to 0x7fe8010e0 ==41211== ==41211== Process terminating with default action of signal 11 (SIGSEGV) ==41211== Access not within mapped region at address 0x7FE8010E0 ==41211== at 0x827873: reserve_stack (thread_pthread.c:684) ==41211== If you believe this happened as a result of a stack ==41211== overflow in your program's main thread (unlikely but ==41211== possible), you can try to increase the size of the ==41211== main thread stack using the --main-stacksize= flag. ==41211== The main thread stack size used in this run was 8388608. ==41211== Stack overflow in thread 1: can't grow stack to 0x7fe8010d9 ==41211== ==41211== Process terminating with default action of signal 11 (SIGSEGV) ==41211== Access not within mapped region at address 0x7FE8010D9 ==41211== at 0x4A226E0: _vgnU_freeres (vg_preloaded.c:58) ==41211== If you believe this happened as a result of a stack ==41211== overflow in your program's main thread (unlikely but ==41211== possible), you can try to increase the size of the ==41211== main thread stack using the --main-stacksize= flag. ==41211== The main thread stack size used in this run was 8388608. Segmentation fault ~~~ GDB: ~~~ gdb-peda$ file ruby gdb-peda$ set args test00-min gdb-peda$ r [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". [New Thread 0x7ffff6c00700 (LWP 48391)] Program received signal SIGSEGV, Segmentation fault. [----------------------------------registers-----------------------------------] RAX: 0x555556679f20 --> 0xd71c RBX: 0xd1 RCX: 0x0 RDX: 0x1 RSI: 0x0 RDI: 0x0 RBP: 0xd71c RSP: 0x7fffffffbe70 --> 0x7fff000000d1 RIP: 0x555555f312f8 (<ruby_yyparse+148344>: mov r11,QWORD PTR [rsi]) R8 : 0x5555566651c0 --> 0x555556678000 (0x00005555566651c0) R9 : 0x0 R10: 0x3900 ('') R11: 0xfffffffffffa360a R12: 0x555556679f20 --> 0xd71c R13: 0x7fffffffc120 --> 0x555556679f48 --> 0xb91c R14: 0x7fffffffbf6c --> 0x55befb3e026f021d R15: 0x555556402060 --> 0x0 EFLAGS: 0x10202 (carry parity adjust zero sign trap INTERRUPT direction overflow) [-------------------------------------code-------------------------------------] 0x555555f312ee <ruby_yyparse+148334>: mov r12,rax 0x555555f312f1 <ruby_yyparse+148337>: mov QWORD PTR [rax],rbp 0x555555f312f4 <ruby_yyparse+148340>: mov rsi,QWORD PTR [r13-0x10] => 0x555555f312f8 <ruby_yyparse+148344>: mov r11,QWORD PTR [rsi] 0x555555f312fb <ruby_yyparse+148347>: and r11d,0x7f00 0x555555f31302 <ruby_yyparse+148354>: cmp r11,0x3900 0x555555f31309 <ruby_yyparse+148361>: jne 0x555555f0ee47 <ruby_yyparse+7879> 0x555555f3130f <ruby_yyparse+148367>: nop [------------------------------------stack-------------------------------------] 0000| 0x7fffffffbe70 --> 0x7fff000000d1 0008| 0x7fffffffbe78 --> 0x555500000000 ('') 0016| 0x7fffffffbe80 --> 0x7fffffffbf60 --> 0xe6004c00020000 0024| 0x7fffffffbe88 --> 0xd1 0032| 0x7fffffffbe90 --> 0xc8 0040| 0x7fffffffbe98 --> 0x0 0048| 0x7fffffffbea0 --> 0x7fffffffc0f0 --> 0x88cf9f52f8c4423 0056| 0x7fffffffbea8 --> 0x7fffffffbf60 --> 0xe6004c00020000 [------------------------------------------------------------------------------] Legend: code, data, rodata, value Stopped reason: SIGSEGV 0x0000555555f312f8 in ruby_yyparse () at parse.y:2105 2105 if (nd_type($1) == NODE_LIT && FIXNUM_P($1->nd_lit) && gdb-peda$ exploit Description: Access violation near NULL on source operand Short description: SourceAvNearNull (16/22) Hash: 8e697703610f21a0a2aaec98723ec089.0b098a66d2dd0257594a0e5fb055f0de Exploitability Classification: PROBABLY_NOT_EXPLOITABLE Explanation: The target crashed on an access violation at an address matching the source operand of the current instruction. This likely indicates a read access violation, which may mean the application crashed on a simple NULL dereference to data structure that has no immediate effect on control of the processor. Other tags: AccessViolation (21/22) Hexdump of the 7-byte test case: 0000000 2070 2928 2e2e 0030 0000007 System Info: Debian 7, Kernel 3.2.65-1+deb7u1 x86_64, GCC 4.9.2, libc 2.13-38+deb7u8