AddressSanitizer (ASan) SUID Executable Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'AddressSanitizer ASan SUID Executable Privilege Escalation', 'Description' = %q This module attempts to gain root privileges on Linux systems usi...

imagemagick/ping_mvg_fuzzer: Crash in GlobExpression

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5703754605658112 Project: imagemagick Fuzzer: libFuzzerimagemagickpingmvgfuzzer Fuzz target binary: pingmvgfuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type: UNKNOWN RE...

readstat/fuzz_format_sav: Bad-free in spss_varinfo_free

Project: https://github.com/WizardMac/ReadStat.git Detailed report: https://oss-fuzz.com/testcase?key=5664754289344512 Project: readstat Fuzzer: aflreadstatfuzzformatsav Fuzz target binary: fuzzformatsav Job Type: aflasanreadstat Platform Id: linux Crash Type: Bad-free Crash Address: 0x000000fcfe...

GattLib 0.2 - Stack Buffer Overflow

Exploit Title: stack-based overflow Date: 2019-11-21 Exploit Author: Dhiraj Mishra Vendor Homepage: http://labapart.com/ Software Link: https://github.com/labapart/gattlib/issues/81 Version: 0.2 Tested on: Linux 4.15.0-38-generic CVE: CVE-2019-6498 References:...

readstat/fuzz_format_sas7bcat: Heap-buffer-overflow in sas_read4

Project: https://github.com/WizardMac/ReadStat.git Detailed report: https://oss-fuzz.com/testcase?key=5658570442407936 Project: readstat Fuzzer: libFuzzerreadstatfuzzformatsas7bcat Fuzz target binary: fuzzformatsas7bcat Job Type: libfuzzerasanreadstat Platform Id: linux Crash Type:...

readstat/fuzz_format_dta: Stack-buffer-overflow in readstat_convert

Project: https://github.com/WizardMac/ReadStat.git Detailed report: https://oss-fuzz.com/testcase?key=5730197242904576 Project: readstat Fuzzer: aflreadstatfuzzformatdta Fuzz target binary: fuzzformatdta Job Type: aflasanreadstat Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 1 Crash...

readstat/fuzz_format_sas7bdat: Heap-buffer-overflow in sas_read4

Project: https://github.com/WizardMac/ReadStat.git Detailed report: https://oss-fuzz.com/testcase?key=4846481717067776 Project: readstat Fuzzer: libFuzzerreadstatfuzzformatsas7bdat Fuzz target binary: fuzzformatsas7bdat Job Type: libfuzzerasanreadstat Platform Id: linux Crash Type:...

readstat/fuzz_format_sav: Heap-buffer-overflow in rt_read_handler

Project: https://github.com/WizardMac/ReadStat.git Detailed report: https://oss-fuzz.com/testcase?key=5656109291929600 Project: readstat Fuzzer: aflreadstatfuzzformatsav Fuzz target binary: fuzzformatsav Job Type: aflasanreadstat Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash...

readstat/fuzz_format_xport: Heap-buffer-overflow in xport_construct_format

Project: https://github.com/WizardMac/ReadStat.git Detailed report: https://oss-fuzz.com/testcase?key=5175181067157504 Project: readstat Fuzzer: aflreadstatfuzzformatxport Fuzz target binary: fuzzformatxport Job Type: aflasanreadstat Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash...

readstat/fuzz_format_sas7bcat: Heap-buffer-overflow in readstat_convert

Project: https://github.com/WizardMac/ReadStat.git Detailed report: https://oss-fuzz.com/testcase?key=5673098437722112 Project: readstat Fuzzer: aflreadstatfuzzformatsas7bcat Fuzz target binary: fuzzformatsas7bcat Job Type: aflasanreadstat Platform Id: linux Crash Type: Heap-buffer-overflow READ ...

libaom/av1_dec_fuzzer: Heap-buffer-overflow in av1_convolve_2d_copy_sr_sse2

Detailed report: https://oss-fuzz.com/testcase?key=5099766910812160 Project: libaom Fuzzer: libFuzzerlibaomav1decfuzzer Fuzz target binary: av1decfuzzer Job Type: libfuzzerasanlibaom Platform Id: linux Crash Type: Heap-buffer-overflow READ 16 Crash Address: 0x63300000005c Crash State:...

wireshark/fuzzshark_ip: Heap-buffer-overflow in reassemble_continuation_state

Detailed report: https://oss-fuzz.com/testcase?key=5697718844915712 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkip Fuzz target binary: fuzzsharkip Job Type: libfuzzerasanwireshark Platform Id: linux Crash Type: Heap-buffer-overflow READ \ Crash Address: 0x606000e761d4 Crash State:...

clamav/clamav_scanfile_PE_fuzzer: Heap-buffer-overflow in unaspack

Detailed report: https://oss-fuzz.com/testcase?key=5673520888020992 Project: clamav Fuzzer: aflclamavscanfilePEfuzzer Fuzz target binary: clamavscanfilePEfuzzer Job Type: aflasanclamav Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60200000700d Crash State: unaspack...

ASAN/SUID - Local Privilege Escalation

!/bin/bash unsanitary.sh - ASAN/SUID Local Root Exploit Exploits er, unsanitized env var passing in ASAN which leads to file clobbering as root when executing setuid root binaries compiled with ASAN. Uses an overwrite of /etc/ld.so.preload to get root on a vulnerable system. Supply your own targe...

ASANSUID - Local Privilege Escalation

ASANSUID - Local Privilege Escalation !/bin/bash unsanitary.sh - ASAN/SUID Local Root Exploit Exploits er, unsanitized env var passing in ASAN which leads to file clobbering as root when executing setuid root binaries compiled with ASAN. Uses an overwrite of /etc/ld.so.preload to get root on a...

libarchive/libarchive_fuzzer: Stack-buffer-overflow in parse_tables

Project: https://github.com/libarchive/libarchive.git Detailed report: https://oss-fuzz.com/testcase?key=5700900719427584 Project: libarchive Fuzzer: afllibarchivefuzzer Fuzz target binary: libarchivefuzzer Job Type: aflasanlibarchive Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 7...

ffmpeg/ffmpeg_AV_CODEC_ID_HYMT_fuzzer: Heap-buffer-overflow in decode_422_bitstream

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5705567736168448 Project: ffmpeg Fuzzer: aflffmpegAVCODECIDHYMTfuzzer Fuzz target binary: ffmpegAVCODECIDHYMTfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Cras...

Internet Bug Bounty: Heap Buffer Overflow (READ: 4) in phar_parse_pharfile

Phar files with HALTCOMPILER; in unexpected places can lead to a buffer overrun. This is something I found while fuzzing with AFL using an ASAN instrumented PHP. The issue can be observed by disabling the ZEND allocator and using ASAN or valgrind/etc? with a crafted phar as input. I have prepared...

Wireshark - get_t61_string Heap Out-of-Bounds Read

Wireshark - gett61string Heap Out-of-Bounds Read The following crash due to a heap-based out-of-bounds memory read can be observed in an ASAN build of Wireshark, by feeding a malformed file to tshark "$ ./tshark -nVxr /path/to/file". --- cut ---...

Wireshark - 'get_t61_string' Heap Out-of-Bounds Read

The following crash due to a heap-based out-of-bounds memory read can be observed in an ASAN build of Wireshark, by feeding a malformed file to tshark "$ ./tshark -nVxr /path/to/file". --- cut --- ================================================================= ==16936==ERROR: AddressSanitizer:...