Question

I have to validate a vulnerability on one of our 64-bit systems which is running glibc-2.9 .

http://scarybeastsecurity.blogspot.in/2011/02/i-got-accidental-code-execution-via.html

The above link gives a script which when passed a magic number apparently leads to arbitrary code execution. But when I tried it on my system, nothing seems to be happening.
Am I doing something wrong? Does the system crash if the vulnerability exists? How do I detect if it’s accidental code execution?

Answer 1

If you were to run into the problem on a 64-bit machine, you’d have to mimic the original code but provide a number that wraps the stack on a 64-bit machine. The original number provided was:

1073741796

$ bc
z=1073741796
z+28
1073741824
(z+28)*4
4294967296
2^32
4294967296
quit
$

So, one way of describing the input number is (ULONG_MAX – 112) / 4.

The analogue number for a 64-bit machine is 4611686018427387876:

$ bc
x=2^64
x
18446744073709551616
y=x/4
y
4611686018427387904
y-28
4611686018427387876
quit
$

However, to stand a chance of this working, you’d have to modify the reported code to use strtroull() or something similar; atoi() is normally limited to 32-bit integers and would be no use on the 64-bit numbers above. The code also contains:

num_as = atoi(argv[1]);
if (num_as < 5) {
    errx(1, "Need 5.");
}
p = malloc(num_as);

Where num_as is a size_t and p is a char *. So, you’d have to be able to malloc() a gargantuan amount of space (almost 4 EiB). Most people don’t have enough virtual memory on their machines, even with disk space for backing, to do that. Now, maybe, just maybe, Linux would allow you to over-commit (and let the OOM Killer swoop in later), but the malloc() would more likely fail.

There were other features that were relevant and affect 32-bit systems in a way that it cannot affect 64-bit systems (yet).

If you’re going to stand a chance of reproducing it on a 64-bit machine, you probably have to do a 32-bit compilation. Then, if the wind is behind you and you have appropriately old versions of the relevant software perhaps you can reproduce it.