Project: upx (upx/upx), language: c++
Vulnerability instance: upx.cve-2023-23457
Sanitizer: address

================= Bug Report (1/2) ==================
## Source: GitHub Issue
## URL: https://github.com/upx/upx/issues/631
## Description:
Issue: upx/upx#631
Title: SEGV on PackLinuxElf64::invert_pt_dynamic
State: closed
Created by: MaggieCwj
Created at: 2022-11-24 02:21:53+00:00
Labels: os:Linux

Issue Body:
This issue tracker is **ONLY** used for reporting bugs.
Please use [stackoverflow](https://stackoverflow.com) for supporting issues.

<!---

IF YOU REMOVE THIS TEMPLATE WE WILL CLOSE YOUR ISSUE WITHOUT RESPONSE.
Just read it and fill in the details we're asking, it saves so much of our time. Thanks!

-->

## What's the problem (or question)?
<!--- If describing a bug, tell us what happens instead of the expected behavior -->
<!--- If suggesting a change/improvement, explain the difference from current behavior -->
UPX4.0.1 shows "Bus Error".
SEGV on /home/chen/upx/src/p_lx_elf.cpp:5783 PackLinuxElf64::invert_pt_dynamic(N_Elf::Dyn<N_Elf::ElfITypes<LE16, LE32, LE64, LE64, LE64> > const*, unsigned long long)

ASAN
```
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2022
UPX git-fdec47+ Markus Oberhumer, Laszlo Molnar & John Reiser   Nov 16th 2022

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
ASAN:SIGSEGV
=================================================================
==33120==ERROR: AddressSanitizer: SEGV on unknown address 0x1000b7ff78d0 (pc 0x000000484c1d bp 0x7fffffffc9f0 sp 0x7fffffffc610 T0)
    #0 0x484c1c in PackLinuxElf64::invert_pt_dynamic(N_Elf::Dyn<N_Elf::ElfITypes<LE16, LE32, LE64, LE64, LE64> > const*, unsigned long long) /home/chen/upx/src/p_lx_elf.cpp:5783
    #1 0x495c66 in PackLinuxElf64::invert_pt_dynamic(N_Elf::Dyn<N_Elf::ElfITypes<LE16, LE32, LE64, LE64, LE64> > const*, unsigned long long) /home/chen/upx/src/p_lx_elf.cpp:825
    #2 0x495c66 in PackLinuxElf64::PackLinuxElf64help1(InputFile*) /home/chen/upx/src/p_lx_elf.cpp:826
    #3 0x496c6a in PackLinuxElf64Le::PackLinuxElf64Le(InputFile*) /home/chen/upx/src/p_lx_elf.h:430
    #4 0x496c6a in PackLinuxElf64amd::PackLinuxElf64amd(InputFile*) /home/chen/upx/src/p_lx_elf.cpp:1042
    #5 0x5757a0 in PackMaster::visitAllPackers(Packer* (*)(Packer*, void*), InputFile*, options_t const*, void*) /home/chen/upx/src/packmast.cpp:194
    #6 0x577311 in PackMaster::getPacker(InputFile*) /home/chen/upx/src/packmast.cpp:238
    #7 0x57744f in PackMaster::pack(OutputFile*) /home/chen/upx/src/packmast.cpp:258
    #8 0x61ca72 in do_one_file(char const*, char*) /home/chen/upx/src/work.cpp:157
    #9 0x61cf89 in do_files(int, int, char**) /home/chen/upx/src/work.cpp:271
    #10 0x45fe9f in upx_main(int, char**) /home/chen/upx/src/main.cpp:1266
    #11 0x407223 in main /home/chen/upx/src/main.cpp:1324
    #12 0x7ffff621f83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
    #13 0x409ef8 in _start (/home/chen/ifcut/upx/upx-asan+0x409ef8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/chen/upx/src/p_lx_elf.cpp:5783 PackLinuxElf64::invert_pt_dynamic(N_Elf::Dyn<N_Elf::ElfITypes<LE16, LE32, LE64, LE64, LE64> > const*, unsigned long long)
==33120==ABORTING
```

gdb
```
(gdb) bt
#0  0x0000000000484c1d in PackLinuxElf64::invert_pt_dynamic (
    this=this@entry=0x61b00001f180, dynp=<optimized out>, headway=<optimized out>)
    at /home/chen/upx/src/p_lx_elf.cpp:5783
#1  0x0000000000495c67 in PackLinuxElf64::invert_pt_dynamic (headway=<optimized out>, 
    dynp=<optimized out>, this=0x61b00001f180) at /home/chen/upx/src/p_lx_elf.cpp:825
#2  PackLinuxElf64::PackLinuxElf64help1 (this=this@entry=0x61b00001f180, 
    f=f@entry=0x7fffffffcc70) at /home/chen/upx/src/p_lx_elf.cpp:826
#3  0x0000000000496c6b in PackLinuxElf64Le::PackLinuxElf64Le (f=0x7fffffffcc70, 
    this=0x61b00001f180) at /home/chen/upx/src/p_lx_elf.h:430
#4  PackLinuxElf64amd::PackLinuxElf64amd (this=0x61b00001f180, f=0x7fffffffcc70)
    at /home/chen/upx/src/p_lx_elf.cpp:1042
#5  0x00000000005757a1 in PackMaster::visitAllPackers (
    func=0x577870 <try_pack(Packer*, void*)>, f=0x7fffffffcc70, o=0x7fffffffce88, 
    user=0x7fffffffcc70) at /home/chen/upx/src/packmast.cpp:194
#6  0x0000000000577312 in PackMaster::getPacker (f=<optimized out>)
    at /home/chen/upx/src/packmast.cpp:238
#7  0x0000000000577450 in PackMaster::pack (this=this@entry=0x7fffffffce70, 
    fo=fo@entry=0x7fffffffcd70) at /home/chen/upx/src/packmast.cpp:258
#8  0x000000000061ca73 in do_one_file (iname=iname@entry=0x7fffffffdede "./POC2", 
    oname=oname@entry=0x7fffffffd4c0 "./POC2.000") at /home/chen/upx/src/work.cpp:157
#9  0x000000000061cf8a in do_files (i=i@entry=1, argc=argc@entry=2, 
    argv=argv@entry=0x7fffffffda98) at /home/chen/upx/src/work.cpp:271
#10 0x000000000045fea0 in upx_main (argc=<optimized out>, argv=<optimized out>)
    at /home/chen/upx/src/main.cpp:1266
#11 0x0000000000407224 in main (argc=2, argv=0x7fffffffda98)
    at /home/chen/upx/src/main.cpp:1324
```

## What should have happened?
<!--- If you're describing a bug, tell us what should happen -->
<!--- If you're suggesting a change/improvement, tell us how it should work -->
No Bus error.

## Do you have an idea for a solution?
<!--- Not obligatory, but suggest a fix/reason for the bug, -->
<!--- or ideas how to implement the addition or change -->

## How can we reproduce the issue?
<!--- Provide unambiguous set of steps to reproduce this bug. Include code to reproduce, if relevant -->
1. Build UPX 4.0.1 (the latest version)
2. Run
` ./upx ./POC2`

zipped poc:
[POC2.zip](https://github.com/upx/upx/files/10080300/POC2.zip)

## Please tell us details about your environment.
<!--- Include as many relevant details about the environment you experienced the bug in -->
* UPX version used (`upx --version`):
```
./upx --version
upx v4.0.1-dirty
UCL data compression library 1.03
zlib data compression library 1.2.13
LZMA SDK version 4.43
doctest C++ testing framework version 2.4.9
Copyright (C) 1996-2022 Markus Franz Xaver Johannes Oberhumer
Copyright (C) 1996-2022 Laszlo Molnar
Copyright (C) 2000-2022 John F. Reiser
Copyright (C) 2002-2022 Jens Medoch
Copyright (C) 1995-2022 Jean-loup Gailly and Mark Adler
Copyright (C) 1999-2006 Igor Pavlov
Copyright (C) 2016-2021 Viktor Kirilov
UPX comes with ABSOLUTELY NO WARRANTY; for details type 'upx -L'.
```
* Host Operating System and version:
`Ubuntu 16.04 LTS`
* Host CPU architecture:
`11th Gen Intel® Core™ i5-11500 @ 2.70GHz × 8`
* Target Operating System and version:
`same as Host`
* Target CPU architecture:
`same as Host`


Comments:
Comment by jreiser on 2022-11-24 04:02:24+00:00:
Fixed by above commit https://github.com/upx/upx/commit/124ae050ae24a941ff78f415db76810e9e34ceb7 .

Attachments:
https://github.com/upx/upx/files/10080300/POC2.zip

Commit References:
124ae050ae24a941ff78f415db76810e9e34ceb7

================= Bug Report (2/2) ==================
## Source: Red Hat Bugzilla
## URL: https://bugzilla.redhat.com/show_bug.cgi?id=2160382
## Description:
Bugzilla ID: 2160382
Title: CVE-2023-23457 upx: SEGV on PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp

Description
TEJ RATHI 2023-01-12 08:26:16 UTC
A Segmentation fault was found in UPX in invert_pt_dynamic() function in p_lx_elf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service.

https://github.com/upx/upx/issues/631
https://github.com/upx/upx/commit/779b648c5f6aa9b33f4728f79dd4d0efec0bf860


Comments:
Comment 1
TEJ RATHI 2023-01-12 08:26:55 UTC
Created upx tracking bugs for this issue:

Affects: epel-all [bug 2160386]
Affects: fedora-all [bug 2160385]

---

Comment 2
Product Security DevOps Team 2023-01-14 05:00:36 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
sed -i 's/ \&\& __clang_major__ < 15//m' /src/upx/src/util/util.cpp
mkdir -p build/debug
cd build/debug
cmake ../..
    cmake --build . --target $fuzz_basename -v

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool cmake
RUN git clone https://github.com/upx/upx upx
RUN git -C upx checkout 9d5e06232d675e27007b6f606df40f47d4431cfb
WORKDIR $SRC/upx
COPY build.sh $SRC/

Additional files: