扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 |
libmad memory corruption vulnerability ================ Author : qflb.wu =============== Introduction: ============= libmad is a high-quality MPEG audio decoder capable of 24-bit output. Affected version: ===== 0.15.1b Vulnerability Description: ========================== the mad_decoder_run function in decoder.c in libmad 0.15.1b can cause a denial of service(memory corruption) via a crafted mp3 file. I found this bug when I test mpg321 0.3.2 which used the libmad library. ./mpg321 libmad_0.15.1b_memory_corruption.mp3 ----debug info:---- Program received signal SIGABRT, Aborted. 0x00007ffff6bf7cc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 56../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt #00x00007ffff6bf7cc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 #10x00007ffff6bfb0d8 in __GI_abort () at abort.c:89 #20x00007ffff6c34394 in __libc_message (do_abort=do_abort@entry=1, fmt=fmt@entry=0x7ffff6d42b28 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175 #30x00007ffff6c4066e in malloc_printerr (ptr=<optimized out>, str=0x7ffff6d42c58 "double free or corruption (out)", action=1) at malloc.c:4996 #4_int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3840 #50x00007ffff749ab43 in mad_decoder_run ( decoder=decoder@entry=0x7fffffffbd20, mode=mode@entry=MAD_DECODER_MODE_SYNC) at decoder.c:559 #60x0000000000403d5d in main (argc=<optimized out>, argv=<optimized out>) at mpg321.c:1092 (gdb) POC: libmad_0.15.1b_memory_corruption.mp3 CVE: CVE-2017-11552 Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42409.zip |
体验盒子
