Stack-based buffer overflow in musl libc 0.8.7 and earlier

[Rich Felker <dalias@aerifal.cx>]

Name: Stack-based buffer overflow in musl libc 0.8.7 and earlier
Software: musl 0.8.7 and earlier
Software link:  http://www.etalabs.net/musl
Vulnerability Type: Buffer overflow
Severity: Critical

Software Description:

musl is an implementation of the C/POSIX standard library for
Linux-based systems. musl aims to be lightweight, fast, simple, free,
and correct in the sense of standards-conformance and safety, and to
meet requirements ranging from embedded systems and initrd images to
desktop workstations, mobile devices, and high-load servers. Several
build-from-source mini-distributions use musl as their C library.

Vulnerability Details:

musl's implementation of [v]fprintf swaps in a temporary FILE buffer
on the stack when writing to unbuffered streams such as stderr. Under
certain conditions where the buffer end pointer has already been set
to the address of the internal degenerate buffer prior to the call to
[v]fprintf, stdio internals can fail to bound access to the temporary
buffer. Large writes will then overflow the temporary buffer and
clobber stack contents, including potentially the return address. Any
program linked to musl which includes potentially-large data from
untrusted sources in its output to stderr or other unbuffered streams
is affected.

Solution:

The vulnerability has been fixed in git, and the fix is to be included
in the upcoming 0.8.8 release. A patch which applies cleanly to all
recent releases is available on the musl mailing list:

http://www.openwall.com/lists/musl/2012/04/17/1

Credits:

This vulnerability was discovered and fixed by the author (myself,
Rich Felker) while debugging a crash occurring in test code written
for musl by Luka Marčetić as part of GSoC 2011.