GNU binutils - 'bfd_get_string' Stack Buffer Overflow

ID EDB-ID:42200
Type exploitdb
Reporter Exploit-DB
Modified 2017-06-19T00:00:00


GNU binutils - 'bfd_get_string' Stack Buffer Overflow. CVE-2017-9747. Dos exploit for Linux platform


I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer.

Please find attached the minimized file causing the issue ("Input") and the
ASAN report log ("Output"). Below is the reduced stacktrace with links to the
corresponding source lines on a GitHub mirror.

The command I used was `objdump -D <file>`.

Let me know if there is any additional information I can provide.


Input: 02d8fa874391d563ccfd5911ff5f5cf8.fe651c9b03ff955c157ecee745208476.min
Output: 02d8fa874391d563ccfd5911ff5f5cf8.fe651c9b03ff955c157ecee745208476.txt

Error in "bfd_get_string": stack-buffer-overflow
  in bfd_get_string at bfd/ieee.c:198
  in read_id at bfd/ieee.c:227
  in ieee_object_p at bfd/ieee.c:1907
  in bfd_check_format_matches at bfd/format.c:311
  in display_object_bfd at binutils/objdump.c:3602
  in display_any_bfd at binutils/objdump.c:3693
  in display_file at binutils/objdump.c:3714
  in main at binutils/objdump.c:4016

Additional Information:
The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.

Proof of Concept: