fuzz CVE-2019-1118

阅读量    119000 | 评论 3

分享到: QQ空间 新浪微博 微信 QQ facebook twitter

 

这篇来分析一下CVE-2019-1118,问题为stack corruption in OpenType font handling due to negative cubeStackDepth

 

漏洞复现

搭建环境,简单复现一下

git clone https://github.com/adobe-type-tools/afdko
cd afdko
git checkout 2.8.8
cd c
bash buildalllinux.sh debug

根据给出的poc测试

可以发现,出错了,但是被afdko捕获了。

这样的话,在重点位置设一下断点,再来看一下

首先测试一下do_blend_cube.otf

pwndbg> b t2cstr.c:1057
Breakpoint 1 at 0x466af2: file ../../../../../source/t2cstr/t2cstr.c, line 1057.
pwndbg> run -cff do_blend_cube.otf

看一下效果

结合着反汇编代码看,效果可能更好

.text:0000000000466AF2                 mov     esi, [rbp+nBlends]
.text:0000000000466AF5                 mov     rdi, [rbp+h]
.text:0000000000466AF9                 add     rdi, 32D60h
.text:0000000000466B00                 mov     rax, [rbp+h]    ; h
.text:0000000000466B04                 movsxd  rax, dword ptr [rax+32D44h]; 取得索引
.text:0000000000466B0B                 imul    rax, 1920h; cube大小
.text:0000000000466B12                 add     rdi, rax
.text:0000000000466B15                 imul    esi, [rdi+10h]
.text:0000000000466B19                 mov     [rbp+nElements], esi

可以发现h->cube数组取值是通过乘法实现的,当索引为-1即h->cubeStackDepth==-1时,

imul rax, 1920h ==> imul 0xffffffff, 1920h

cube数组每项的大小:sizeof(h->cube[0]) == 0x1920

再变换一下

((struct cube)h->cube)-1

相当于h->cube指针向前移动了一个数组值,即0x1920个字节

再来看看struct _t2cCtx的大小

向前移动了,但是((struct cube)h->cube)-1的位置还是在_t2cCtx结构体中,验证一下

继续单步执行到这,索引值得出

继续si

此时

可以发现0x9d3f8 > 0x31880 ,验证也确实还在结构体中。

这样的话,即使是h->cubeStackDepth==-1也不会导致内存访问出错,最多也就是分析错误,被afkdo捕获也就不奇怪了。我们的结果也确实是这样

但是PJ0给的例子中,存在了一个叫做redzone patch的操作,打完patch之后会出现user-after-poison的错误。

就像这样

==96052==ERROR: AddressSanitizer: use-after-poison on address 0x7ffea1a88890 at pc 0x00000069e6e2 bp 0x7ffea1a46bb0 sp 0x7ffea1a46ba8
READ of size 4 at 0x7ffea1a88890 thread T0
    #0 0x69e6e1 in do_blend_cube afdko/c/public/lib/source/t2cstr/t2cstr.c:1057:58
    #1 0x6855fd in t2Decode afdko/c/public/lib/source/t2cstr/t2cstr.c:1857:38
    #2 0x670a5b in t2cParse afdko/c/public/lib/source/t2cstr/t2cstr.c:2591:18
    #3 0x542960 in readGlyph afdko/c/public/lib/source/cffread/cffread.c:2927:14
    #4 0x541c32 in cfrIterateGlyphs afdko/c/public/lib/source/cffread/cffread.c:2966:9
    #5 0x509662 in cfrReadFont afdko/c/tx/source/tx.c:151:18
    #6 0x508cc3 in doFile afdko/c/tx/source/tx.c:429:17
    #7 0x506b2e in doSingleFileSet afdko/c/tx/source/tx.c:488:5
    #8 0x4fc91e in parseArgs afdko/c/tx/source/tx.c:558:17
    #9 0x4f9470 in main afdko/c/tx/source/tx.c:1631:9
    #10 0x7fa93072e2b0 in __libc_start_main
    #11 0x41e5b9 in _start

如果我们想这样的话,该怎么

做呢?

很遗憾,关于手动设置redzone的资料特别少,中文基本上就是纯空白了。而且我发现,基本上这个方法就是PJ0自己成员在用,其他人很少有使用过的。

为了实现这个功能,我把sanitizer的实现资料和相关redzone的源码全部简单过了一遍,最后弄懂了redzone的相关定义和用法,这部分想要了解的话,自己查资料吧,内容比较多,可以重点看一下PJ0介绍sanitizer的几个paper。

最后在sanitizer/asan_interface.h中看到了这部分代码

//===-- sanitizer/asan_interface.h ------------------------------*- C++ -*-===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
//
// This file is a part of AddressSanitizer (ASan).
//
// Public interface header.
//===----------------------------------------------------------------------===//
#ifndef SANITIZER_ASAN_INTERFACE_H
#define SANITIZER_ASAN_INTERFACE_H

#include <sanitizer/common_interface_defs.h>

#ifdef __cplusplus
extern "C" {
#endif
/// Marks a memory region (<c>[addr, addr+size)</c>) as unaddressable.
///
/// This memory must be previously allocated by your program. Instrumented
/// code is forbidden from accessing addresses in this region until it is
/// unpoisoned. This function is not guaranteed to poison the entire region -
/// it could poison only a subregion of <c>[addr, addr+size)</c> due to ASan
/// alignment restrictions.
///
/// \note This function is not thread-safe because no two threads can poison or
/// unpoison memory in the same memory region simultaneously.
///
/// \param addr Start of memory region.
/// \param size Size of memory region.
void __asan_poison_memory_region(void const volatile *addr, size_t size);

/// Marks a memory region (<c>[addr, addr+size)</c>) as addressable.
///
/// This memory must be previously allocated by your program. Accessing
/// addresses in this region is allowed until this region is poisoned again.
/// This function could unpoison a super-region of <c>[addr, addr+size)</c> due
/// to ASan alignment restrictions.
///
/// \note This function is not thread-safe because no two threads can
/// poison or unpoison memory in the same memory region simultaneously.
///
/// \param addr Start of memory region.
/// \param size Size of memory region.
void __asan_unpoison_memory_region(void const volatile *addr, size_t size);

// Macros provided for convenience.
#if __has_feature(address_sanitizer) || defined(__SANITIZE_ADDRESS__)
/// Marks a memory region as unaddressable.
///
/// \note Macro provided for convenience; defined as a no-op if ASan is not
/// enabled.
///
/// \param addr Start of memory region.
/// \param size Size of memory region.
#define ASAN_POISON_MEMORY_REGION(addr, size) \
  __asan_poison_memory_region((addr), (size))

/// Marks a memory region as addressable.
///
/// \note Macro provided for convenience; defined as a no-op if ASan is not
/// enabled.
///
/// \param addr Start of memory region.
/// \param size Size of memory region.
#define ASAN_UNPOISON_MEMORY_REGION(addr, size) \
  __asan_unpoison_memory_region((addr), (size))
#else
#define ASAN_POISON_MEMORY_REGION(addr, size) \
  ((void)(addr), (void)(size))
#define ASAN_UNPOISON_MEMORY_REGION(addr, size) \
  ((void)(addr), (void)(size))
#endif

宏定义ASAN_UNPOISON_MEMORY_REGION指向__asan_poison_memory_region,利用这个函数可以设置redzone,之后利用__asan_unpoison_memory_region解除设置

方法找到了,那就来看具体代码,设置redzone,在do_blend_cube函数中

/* Execute "blend" op. Return 0 on success else error code. */
static int do_blend_cube(t2cCtx h, int nBlends) {
    int i;
    __asan_poison_memory_region(h->cube-1, sizeof(struct _t2cCtx)); // 设置redzone
    int nElements = nBlends * h->cube[h->cubeStackDepth].nMasters;
    int iBase = h->stack.cnt - nElements;
    int k = iBase + nBlends;

    if (h->cube[h->cubeStackDepth].nMasters <= 1)
        return t2cErrInvalidWV;
    CHKUFLOW(h, nElements);

    if (h->flags & FLATTEN_CUBE) {
        for (i = 0; i < nBlends; i++) {
            int j;
            double x = INDEX(iBase + i);
            for (j = 1; j < h->cube[h->cubeStackDepth].nMasters; j++)
                x += INDEX(k++) * h->cube[h->cubeStackDepth].WV[j];
            INDEX(iBase + i) = (float)x;
        }
    } else {
        float blendVals[kMaxCubeMasters * kMaxBlendOps];
        for (i = 0; i < nElements; i++) {
            blendVals[i] = INDEX(iBase + i);
        }
        callback_blend_cube(h, nBlends, nElements, blendVals);
    }

    h->stack.cnt = iBase + nBlends;

    __asan_unpoison_memory_region(h->cube-1, sizeof(struct _t2cCtx)); // 解除redzone

    return 0;
}

这里有一点需要注意,poison的size一定要设置的够大,否则会没有poison的效果,我这里是取_t2cCtx结构体的大小,这样就保证了怎么移动我们都能检测到

来看一下效果

 

fuzzing 代码

还是这么写main函数

/* Main program. */
int CTL_CDECL main(int argc, char *argv[]) {
    txCtx h;
    char *progname;

    /* Get program name */
    progname = tail(argv[0]);
    --argc;
    ++argv;

    /* Allocate program context */
    h = malloc(sizeof(struct txCtx_));
    if (h == NULL) {
        fprintf(stderr, "%s: out of memory\n", progname);
        return EXIT_FAILURE;
    }
    memset(h, 0, sizeof(struct txCtx_));

    h->app = APP_TX;
    h->appSpecificInfo = NULL; /* unused in tx.c, used in rotateFont.c & mergeFonts.c */
    h->appSpecificFree = txFree;

    txNew(h, progname);

    h->t1r.flags = 0; /* I initialize these here,as I need to set the std Encoding flags before calling setMode. */
    h->cfr.flags = 0;
    h->cfw.flags = 0;
    h->dcf.flags = DCF_AllTables | DCF_BreakFlowed;
    h->dcf.level = 5;
    h->svr.flags = 0;
    h->ufr.flags = 0;
    h->ufow.flags = 0;
    h->t1w.options = 0;

    // 设置cff模式
    setMode(h, mode_cff);

    // argv[1] 文件名,对应上面argv--
    doSingleFileSet(h, argv[0]);

    if (h->failmem.iFail == FAIL_REPORT) {
        fflush(stdout);
        fprintf(stderr, "mem_manage() called %ld times in this run.\n",
                h->failmem.iCall);
    }
    txFree(h);

    return 0;
}

出现异常利用上面的测试一下即可。

fuzz代码我公开了,测出有效洞可得找我哈 : )

还不会的话,只能看我的具体项目了,一起学习fuzz哈

 

参考

Microsoft DirectWrite / AFDKO stack corruption in OpenType font handling due to negative cubeStackDepth

分享到: QQ空间 新浪微博 微信 QQ facebook twitter
|推荐阅读
|发表评论
|评论列表
加载更多