GNU binutils - 'aarch64_ext_ldst_reglist' Buffer Overflow

EDB-ID: 42204
Author: Alexandre Adamski
Published: 2017-06-19
CVE: CVE-2017-9756
Type: Dos
Platform: Linux
Aliases: N/A
Advisory/Source: Link
Tags: N/A
Vulnerable App: N/A

I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer.

Please find attached the minimized file causing the issue ("Input") and the ASAN report log ("Output"). Below is the reduced stacktrace with links to the corresponding source lines on a GitHub mirror.

The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.

Let me know if there is any additional information I can provide.


Input: 3ade4a4333249762a9df82c47f3c111a.65dbcbffa0f6467be847e1372688623b.min
Output: 3ade4a4333249762a9df82c47f3c111a.65dbcbffa0f6467be847e1372688623b.txt

Error in "aarch64_ext_ldst_reglist": global-buffer-overflow
in aarch64_ext_ldst_reglist at opcodes/aarch64-dis.c:412
in aarch64_opcode_decode at opcodes/aarch64-dis.c:2739
in aarch64_decode_insn at opcodes/aarch64-dis.c:2831
in print_insn_aarch64_word at opcodes/aarch64-dis.c:2973
in print_insn_aarch64 at opcodes/aarch64-dis.c:3209
in disassemble_bytes at binutils/objdump.c:1864
in disassemble_section at binutils/objdump.c:2309
in bfd_map_over_sections at bfd/section.c:1395
in disassemble_data at binutils/objdump.c:2445
in dump_bfd at binutils/objdump.c:3547
in display_file at binutils/objdump.c:3714
in main at binutils/objdump.c:4016

Proof of Concept:

Related Posts