Buffer Overflow in cplus-dem.c

vendor:

cplus-dem.c

by:

GNU

7,5

CVSS

HIGH

Buffer Overflow

120

CWE

Product Name: cplus-dem.c

Affected Version From: 2.6.32-573.7.1.el6.x86_64

Affected Version To: 4.1.12-boot2docker

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2015

Buffer Overflow in cplus-dem.c

The attached program binary causes a buffer overflow in cplus-dem.c when it tries to demangle specially crafted function arguments in the binary. Both the buffer size as well as the buffer content are controlled from the binary.

Mitigation:

Ensure that the buffer size is properly checked and validated before processing the data.

Source

Exploit-DB raw data:

Source: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69687


The attached program binary causes a buffer overflow in cplus-dem.c when it tries to demangle specially crafted function arguments in the binary. Both the buffer size as well as the buffer content are controlled from the binary.

objdump -x -C <file>
nm -C <file>

Tested on the following configurations
* 2.6.32-573.7.1.el6.x86_64 #1 SMP Tue Sep 22 22:00:00 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
* 4.1.12-boot2docker #1 SMP Tue Nov 3 06:03:36 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
* Binutils versions: 2.20 and 2.26


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42386.zip