From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/721 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general,gmane.comp.security.oss.general Subject: Stack-based buffer overflow in musl libc 0.8.7 and earlier Date: Wed, 18 Apr 2012 02:32:58 -0400 Message-ID: <20120418063258.GA32320@brightrain.aerifal.cx> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Trace: dough.gmane.org 1334730640 12532 80.91.229.3 (18 Apr 2012 06:30:40 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Wed, 18 Apr 2012 06:30:40 +0000 (UTC) Cc: musl@lists.openwall.com To: oss-security@lists.openwall.com Original-X-From: musl-return-722-gllmg-musl=m.gmane.org@lists.openwall.com Wed Apr 18 08:30:35 2012 Return-path: Envelope-to: gllmg-musl@plane.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1SKOPS-0005Jq-6j for gllmg-musl@plane.gmane.org; Wed, 18 Apr 2012 08:30:34 +0200 Original-Received: (qmail 22015 invoked by uid 550); 18 Apr 2012 06:30:33 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 21990 invoked from network); 18 Apr 2012 06:30:33 -0000 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Xref: news.gmane.org gmane.linux.lib.musl.general:721 gmane.comp.security.oss.general:7456 Archived-At: Name: Stack-based buffer overflow in musl libc 0.8.7 and earlier Software: musl 0.8.7 and earlier Software link: http://www.etalabs.net/musl Vulnerability Type: Buffer overflow Severity: Critical Software Description: musl is an implementation of the C/POSIX standard library for Linux-based systems. musl aims to be lightweight, fast, simple, free, and correct in the sense of standards-conformance and safety, and to meet requirements ranging from embedded systems and initrd images to desktop workstations, mobile devices, and high-load servers. Several build-from-source mini-distributions use musl as their C library. Vulnerability Details: musl's implementation of [v]fprintf swaps in a temporary FILE buffer on the stack when writing to unbuffered streams such as stderr. Under certain conditions where the buffer end pointer has already been set to the address of the internal degenerate buffer prior to the call to [v]fprintf, stdio internals can fail to bound access to the temporary buffer. Large writes will then overflow the temporary buffer and clobber stack contents, including potentially the return address. Any program linked to musl which includes potentially-large data from untrusted sources in its output to stderr or other unbuffered streams is affected. Solution: The vulnerability has been fixed in git, and the fix is to be included in the upcoming 0.8.8 release. A patch which applies cleanly to all recent releases is available on the musl mailing list: http://www.openwall.com/lists/musl/2012/04/17/1 Credits: This vulnerability was discovered and fixed by the author (myself, Rich Felker) while debugging a crash occurring in test code written for musl by Luka Marčetić as part of GSoC 2011.