<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style='--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'>
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'>
<div class="content">
<h3 style="margin-top: 20px; margin-bottom: 10px;">
Tobias Frost pushed to branch master at <a href="https://salsa.debian.org/security-tracker-team/security-tracker">Debian Security Tracker / security-tracker</a>
</h3>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
Commits:
</h4>
<ul>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3a370da8685fe6153463df8346f3f4110cb1107f">3a370da8</a></strong>
<div>
<span> by Tobias Frost </span> <i> at 2025-01-11T16:50:44+01:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #28272d; position: relative; font-family: "GitLab Mono","JetBrains Mono","Menlo","DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-42363/busybox - document triage with poc results.
The instructions how to run the poc and the data files are in the upstream ticket.
poc triggers on bookworm, but not on bullseye, details below.
For CVE-2021-42377 remove not-affected annotation for ELTS so that this
is aligned with the usage of the state. Thanks to carnil for their in depth explaration.
bookworm:
SUMMARY: AddressSanitizer: heap-use-after-free (/home/tobi/workspace/deb/Xlts/Repositories/busybox/unstable/busybox-1.35.0/busybox_unstripped+0x4a2036) (BuildId: cc32b22f94f821d020fdcf2b02f27c6819feb733)
Shadow bytes around the buggy address:
0x502000023480: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x502000023500: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x502000023580: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x502000023600: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x502000023680: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 02 fa
=>0x502000023700: fa fa[fd]fa fa fa fd fa fa fa fd fa fa fa fd fa
0x502000023780: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd
0x502000023800: fa fa 02 fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000023880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000023900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000023980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==429114==ABORTING
Aborted
bullseye only reports some leaks:
================================================================
==206956==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 768 byte(s) in 24 object(s) allocated from:
#0 0x49d90d (/home/tobi/build/busybox-poc/busybox_unstripped+0x49d90d)
#1 0x4d7292 (/home/tobi/build/busybox-poc/busybox_unstripped+0x4d7292)
#2 0x4c85e5 (/home/tobi/build/busybox-poc/busybox_unstripped+0x4c85e5)
Direct leak of 32 byte(s) in 1 object(s) allocated from:
#0 0x49d90d (/home/tobi/build/busybox-poc/busybox_unstripped+0x49d90d)
#1 0x4d7292 (/home/tobi/build/busybox-poc/busybox_unstripped+0x4d7292)
#2 0xe251a8 (/home/tobi/build/busybox-poc/busybox_unstripped+0xe251a8)
#3 0x4c85e5 (/home/tobi/build/busybox-poc/busybox_unstripped+0x4c85e5)
Indirect leak of 64 byte(s) in 2 object(s) allocated from:
#0 0x49d90d (/home/tobi/build/busybox-poc/busybox_unstripped+0x49d90d)
#1 0x4d7292 (/home/tobi/build/busybox-poc/busybox_unstripped+0x4d7292)
#2 0x4c85e5 (/home/tobi/build/busybox-poc/busybox_unstripped+0x4c85e5)
SUMMARY: AddressSanitizer: 864 byte(s) leaked in 27 allocation(s).
</pre>
</li>
</ul>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
1 changed file:
</h4>
<ul>
<li class="file-stats">
<a href="#4716ef5aa8f2742228ba3b3633215c8b808565e3">
data/CVE/list
</a>
</li>
</ul>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
Changes:
</h4>
<li id="4716ef5aa8f2742228ba3b3633215c8b808565e3">
<a href="https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3a370da8685fe6153463df8346f3f4110cb1107f#4716ef5aa8f2742228ba3b3633215c8b808565e3"><strong style="font-weight: 600;">data/CVE/list</strong></a>
<hr style="overflow: hidden; border: 1px solid #e1e1e1;">
No preview for this file type
<br>
</li>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #737278;">
—
<br>
<a href="https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3a370da8685fe6153463df8346f3f4110cb1107f">View it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://salsa.debian.org">salsa.debian.org</a>. <a href="https://salsa.debian.org/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://salsa.debian.org/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Commit","url":"https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3a370da8685fe6153463df8346f3f4110cb1107f"}}</script>
</p>
</div>
</body>
</html>