[Bug 15601] New: CVE-2021-42380 unrepaired or new issues introduced by fixing CVE-2021-42380.

[bugzilla at busybox.net]

https://bugs.busybox.net/show_bug.cgi?id=15601

            Bug ID: 15601
           Summary: CVE-2021-42380 unrepaired or new issues introduced by
                    fixing CVE-2021-42380.
           Product: Busybox
           Version: unspecified
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: Standard Compliance
          Assignee: unassigned at busybox.net
          Reporter: magicgoogol at gmail.com
                CC: busybox-cvs at busybox.net
  Target Milestone: ---

Created attachment 9601
  --> https://bugs.busybox.net/attachment.cgi?id=9601&action=edit
poc

Discoverer: Taolaw at Vlab of Vecentek

$ ./busybox_unstripped awk -f '/home/fuzz/vuln_search/poc/CVE-2021-42380'
'/home/fuzz/vuln_search/poc/1.txt' 

─ process timing ────────────────────────────────────┬─ ─ process timing
──────────────────── results ────┐──┬─ overall results ────┐
 days, 0 hrs, 0 min, 56 sec │ cycles done : 0 │ 0 min, 56 sec      │  cycles
done : 0     │
│ last new find │   last new find : 0 days, 0 hrs, 0 min, 1 sec       │ corpus
count : 208    0 days, 0 hrs, 0 min, 1 sec │ corpus count : 208 │
│last saved crash : │last saved crash : none seen yet                    
│saved crashes : 0  seen yet │saved crashes : 0 │
│ last saved hang │ last saved hang : none seen yet                     │ 
saved hangs : 0    none seen yet │ saved hangs : 0 │
├─ cycle progress ─────────────────────┬─ ├─ cycle progress
─────────────────────┬─ map cover coverage┴──────────────────────┤
=================================================================
==474939==ERROR: AddressSanitizer: heap-use-after-free on address
0x619000000b00 at pc 0x558ba8a13137 bp 0x7ffcfb7b8990 sp 0x7ffcfb7b8980
READ of size 4 at 0x619000000b00 thread T0
    #0 0x558ba8a13136 in clrvar
(/home/fuzz/vuln_search/busybox/busybox-1.36.1/busybox_unstripped+0x9c8136)

0x619000000b00 is located 128 bytes inside of 1088-byte region
[0x619000000a80,0x619000000ec0)
freed by thread T0 here:
    #0 0x7f1e23748c3e in __interceptor_realloc
../../../../src/libsanitizer/asan/asan_malloc_linux.cc:163
    #1 0x558ba87009dc in xrealloc
(/home/fuzz/vuln_search/busybox/busybox-1.36.1/busybox_unstripped+0x6b59dc)

previously allocated by thread T0 here:
    #0 0x7f1e23748c3e in __interceptor_realloc
../../../../src/libsanitizer/asan/asan_malloc_linux.cc:163
    #1 0x558ba87009dc in xrealloc
(/home/fuzz/vuln_search/busybox/busybox-1.36.1/busybox_unstripped+0x6b59dc)

SUMMARY: AddressSanitizer: heap-use-after-free
(/home/fuzz/vuln_search/busybox/busybox-1.36.1/busybox_unstripped+0x9c8136) in
clrvar
Shadow bytes around the buggy address:
  0x0c327fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8150: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c327fff8160:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fff8170: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fff8180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fff8190: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fff81a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fff81b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==474939==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.