libmad 0.15.1b – ‘mp3’ Memory Corruption

• Exploit Database
• 17 阅读

• 作者： qflb.wu
  日期： 2017-08-01
• 类别：

  • dos
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/42409/

• libmad memory corruption vulnerability
  ================
  Author : qflb.wu
  ===============
  
  
  Introduction:
  =============
  libmad is a high-quality MPEG audio decoder capable of 24-bit output.
  
  
  Affected version:
  =====
  0.15.1b
  
  
  Vulnerability Description:
  ==========================
  the mad_decoder_run function in decoder.c in libmad 0.15.1b can cause a denial of service(memory corruption) via a crafted mp3 file.
  
  
  I found this bug when I test mpg321 0.3.2 which used the libmad library.
  
  
  ./mpg321 libmad_0.15.1b_memory_corruption.mp3
  
  
  ----debug info:----
  Program received signal SIGABRT, Aborted.
  0x00007ffff6bf7cc9 in __GI_raise (sig=sig@entry=6)
  at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
  56../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
  (gdb) bt
  #00x00007ffff6bf7cc9 in __GI_raise (sig=sig@entry=6)
  at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
  #10x00007ffff6bfb0d8 in __GI_abort () at abort.c:89
  #20x00007ffff6c34394 in __libc_message (do_abort=do_abort@entry=1, 
  fmt=fmt@entry=0x7ffff6d42b28 "*** Error in `%s': %s: 0x%s ***\n")
  at ../sysdeps/posix/libc_fatal.c:175
  #30x00007ffff6c4066e in malloc_printerr (ptr=<optimized out>, 
  str=0x7ffff6d42c58 "double free or corruption (out)", action=1)
  at malloc.c:4996
  #4_int_free (av=<optimized out>, p=<optimized out>, have_lock=0)
  at malloc.c:3840
  #50x00007ffff749ab43 in mad_decoder_run (
  decoder=decoder@entry=0x7fffffffbd20, 
  mode=mode@entry=MAD_DECODER_MODE_SYNC) at decoder.c:559
  #60x0000000000403d5d in main (argc=<optimized out>, argv=<optimized out>)
  at mpg321.c:1092
  (gdb)
  
  
  POC:
  libmad_0.15.1b_memory_corruption.mp3
  CVE:
  CVE-2017-11552
  
  
  Proof of Concept:
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42409.zip