A buffer overflow was discovered in the GNU C Library’s dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

了解一下tunables相关内容 https://www.gnu.org/software/libc/manual/html_node/Tunables.html

Tunables are a feature in the GNU C Library that allows application authors and distribution maintainers to alter the runtime library behavior to match their workload.

形式是由环境变量GLIBC_TUNABLES指示的由”:”分隔的键值对序列,如:
GLIBC_TUNABLES=glibc.malloc.trim_threshold=128:glibc.malloc.check=3

CVE-2012-2836 CVE-2009-3895 libexif 整数溢出

2024-03-11

Pwn / 应用层

libexif-0.6.14.

CVE-2012-2836

-s 123跑几分钟,出了13个crash,栈回溯分一下类,一共4种路径

崩溃分析

crash 0:
调用exif_data_load_data_thumbnail函数时size参数明显过大,且正好是unsigned int的最大值,猜测是个整数溢出或错误的类型转换(int32_t转uint32_t).

CVE-2019-13288 xpdf 无限递归

2024-03-10

Pwn / 应用层

CVE-2019-13288

xpdf-3.02.
放两个最简单的pdf作为input,-s 123开跑.5秒后出现第一个crash.

崩溃分析

用第一个crash样例,复现一下

AFL 源码分析

2024-03-07

模糊测试

只要吃透了AFL的源码，就能掌握绝⼤部分fuzzer的要领

前言

源码分析之前需先对AFL有个基本的认识,可以看看这篇文章: https://xidoo.top/2022/01/afl-white-book
本文按照时序对afl-fuzz.c进行分析.相应函数在第一次调用点进行分析.
参考文章:https://eternalsakura13.com/2020/08/23/afl/

CVE-2018-10387 TFTP Server 堆溢出

2024-02-17

Pwn / 应用层

分析

首先查看漏洞报告:

Heap-based overflow vulnerability in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or possibly execute arbitrary code via a long TFTP error packet, a different vulnerability than CVE-2008-2161.

程序是一个开源的TFTP协议服务器.下载v1.66源码到本地.