Incorrect boundary check leading to the out-of-bound memory access
pcy190 opened this issue · 1 comments
pcy190 commented
Details
The bounds_check
function does not check whether the address + size
overflows. When address
is large enough, the result of (char*)addr + size
would overflow and bypass the check of ((char*)addr + size) <= ((char*)mem + mem_len))
, leading to the ouf-of-bound memory access.
Lines 1176 to 1181 in 7d6da19
Running the PoC code of ldxdw %r6, [%r3-1]
can get the invalid memory access:
==135970==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0xffffffffffffffff (pc 0x55bd7a299153 bp 0xffffffffffffffff sp 0x7fff2badf2c0 T135970)
==135970==The signal is caused by a READ memory access.
#0 0x55bd7a299153 in ubpf_mem_load /ubpf/vm/ubpf_vm.c
#1 0x55bd7a299153 in ubpf_exec /ubpf/vm/ubpf_vm.c:626:29
Patch suggestion
In the bounds_check
function, add the following check:
if ( ((size_t)addr + size) < (size_t)addr) {
return false;
}
Alan-Jowett commented
Thanks @pcy190, this should now be fixed.