Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

debug/elf: parsing Malware Elf File causes a panic in debug/elf.NewFile #47445

Closed
kkireeva-stairwell opened this issue Jul 28, 2021 · 5 comments
Closed

debug/elf: parsing Malware Elf File causes a panic in debug/elf.NewFile #47445

kkireeva-stairwell opened this issue Jul 28, 2021 · 5 comments
Labels
compiler/runtime Issues related to the Go compiler and/or runtime. FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone
Backlog

Comments

@kkireeva-stairwell
Copy link

What version of Go are you using (go version)?

go version go1.16 linux/amd64

Does this issue reproduce with the latest release?

We are using the latest release, and have the issue.

What operating system and processor architecture are you using (go env)?

go env Output
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/kkireeva/.cache/go-build"
GOENV="/home/kkireeva/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/kkireeva/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/kkireeva/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.16"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/kkireeva/S/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build2654800752=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Gave it a file that had a magic number that made it appear to be an elf file.

Giving malformed elf file to elf.NewFile causes an out of bounds error.
File had ELF magic number, but giving it to the elf.NewFile function caused an out of
bounds exception.

runtime error: slice bounds out of range [:-4586507407861017164]
at io.(*SectionReader).Read (io.go:498)
at io.ReadAtLeast (io.go:328)
at io.ReadFull (io.go:347)
at encoding/binary.Read (binary.go:256)
at debug/elf.NewFile (file.go:438)
at [REDACTED]/elf.(*Parser).Parse (elf.go:39)

I am happy to attach the offending file, however, it is malware. Please let me know if you would like me to attach it.

What did you expect to see?

I expected the elf library to either return a *File object with the File Header and Section variables filled out,
or I expected the elf library to return an error without causing a panic()

What did you see instead?

The elf library caused a panic, resulting in the stack-trace above.
The file was possibly malformed, ie did not conform to the ELF formatting standards.
I suspect issue is that it the ELF file was malware.
@randall77
Copy link
Contributor

Dup of #45599 ?

@kkireeva-stairwell
Copy link
Author

I don't believe it's the same issue. I think in this case the elf library is not checking if a read value makes sense before using it in further computations.

@randall77
Copy link
Contributor

I think it's just a question of whether that bad read value is passed to make (#45599) or [] (this issue). The underlying issue is the same, in that debug/elf is currently not designed to handle corrupt input in a robust way.

@cagedmantis cagedmantis changed the title Parsing Malware Elf File causes a panic in debug/elf.NewFile debug/elf: parsing Malware Elf File causes a panic in debug/elf.NewFile Jul 30, 2021
@cagedmantis cagedmantis added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Jul 30, 2021
@cagedmantis cagedmantis added this to the Backlog milestone Jul 30, 2021
@ianlancetaylor
Copy link
Contributor

More or less a dup of #47653.

@gopherbot gopherbot added the compiler/runtime Issues related to the Go compiler and/or runtime. label Jul 13, 2022
@ianlancetaylor
Copy link
Contributor

We've made a lot of changes to debug/elf and this is most likely fixed on tip. Optimistically closing. If you still see problems, please send me the file. Thanks.

@ianlancetaylor ianlancetaylor closed this as not planned Won't fix, can't repro, duplicate, stale Oct 10, 2022
@golang golang locked and limited conversation to collaborators Oct 10, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
compiler/runtime Issues related to the Go compiler and/or runtime. FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Milestone
Backlog
Development

No branches or pull requests
5 participants
@cagedmantis @ianlancetaylor @randall77 @gopherbot @kkireeva-stairwell