{"action":"created","issue":{"url":"https://api.github.com/repos/marcobambini/gravity/issues/123","repository_url":"https://api.github.com/repos/marcobambini/gravity","labels_url":"https://api.github.com/repos/marcobambini/gravity/issues/123/labels{/name}","comments_url":"https://api.github.com/repos/marcobambini/gravity/issues/123/comments","events_url":"https://api.github.com/repos/marcobambini/gravity/issues/123/events","html_url":"https://github.com/marcobambini/gravity/issues/123","id":220118930,"number":123,"title":"Double Free Vulnerability ","user":{"login":"blindfuzzy","id":18170510,"avatar_url":"https://avatars0.githubusercontent.com/u/18170510?v=3","gravatar_id":"","url":"https://api.github.com/users/blindfuzzy","html_url":"https://github.com/blindfuzzy","followers_url":"https://api.github.com/users/blindfuzzy/followers","following_url":"https://api.github.com/users/blindfuzzy/following{/other_user}","gists_url":"https://api.github.com/users/blindfuzzy/gists{/gist_id}","starred_url":"https://api.github.com/users/blindfuzzy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blindfuzzy/subscriptions","organizations_url":"https://api.github.com/users/blindfuzzy/orgs","repos_url":"https://api.github.com/users/blindfuzzy/repos","events_url":"https://api.github.com/users/blindfuzzy/events{/privacy}","received_events_url":"https://api.github.com/users/blindfuzzy/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-04-07T05:59:36Z","updated_at":"2017-04-07T15:14:14Z","closed_at":"2017-04-07T14:27:51Z","body":"Tested against latest updates and the issue still remains.. @marcobambini \r\n\r\nI found a Double Free vulnerability while fuzzing Gravity. I have attached the Valgrind output as well. If the crash and/or core dump file is needed let me know and I will get those to you as well. \r\n\r\n[Gravity_valgrind.txt](https://github.com/marcobambini/gravity/files/904640/Gravity_valgrind.txt)\r\n\r\n\r\nASAN output: \r\n\r\n> $ ~/Exploit-Dev/TESTS/IN/gravity/gravity '/home/robin/Exploit-Dev/TESTS/OUT/SYNC3/master/crashes/id:000006,sig:06,src:000012,op:ext_AO,pos:201'\r\n> RUNTIME ERROR: Unable to find f2 into class foo\r\n> \r\n> ==7734==ERROR: AddressSanitizer: attempting double-free on 0x60200000e250 in thread T0:\r\n>     #0 0x7f12b68432ca in __interceptor_free (/usr/lib/gcc/x86_64-linux-gnu/5/libasan.so+0x982ca)\r\n>     #1 0x456e19 in gravity_class_free_internal src/shared/gravity_value.c:371\r\n>     #2 0x456cc7 in gravity_class_free_core src/shared/gravity_value.c:383\r\n>     #3 0x444323 in gravity_core_free src/runtime/gravity_core.c:2226\r\n>     #4 0x46a9b1 in main src/cli/gravity.c:234\r\n>     #5 0x7f12b5ef182f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)\r\n>     #6 0x401808 in _start (/home/robin/Exploit-Dev/TESTS/IN/gravity/gravity+0x401808)\r\n> \r\n> 0x60200000e250 is located 0 bytes inside of 8-byte region [0x60200000e250,0x60200000e258)\r\n> freed by thread T0 here:\r\n>     #0 0x7f12b68432ca in __interceptor_free (/usr/lib/gcc/x86_64-linux-gnu/5/libasan.so+0x982ca)\r\n>     #1 0x456e19 in gravity_class_free_internal src/shared/gravity_value.c:371\r\n> \r\n> previously allocated by thread T0 here:\r\n>     #0 0x7f12b684379a in __interceptor_calloc (/usr/lib/gcc/x86_64-linux-gnu/5/libasan.so+0x9879a)\r\n>     #1 0x4694e2 in string_dup src/utils/gravity_utils.c:326\r\n> \r\n> SUMMARY: AddressSanitizer: double-free ??:0 __interceptor_free\r\n> ==7734==ABORTING\r\n\r\nPOC thanks to @tylerp96 : \r\n\r\n> **Gravity Double Free Vulnerability\r\n> 4/7/2017**\r\n> \r\n> class foo\r\n> {\r\n> \tfunc f1() {return 10;}\r\n> }\r\n> \r\n> func main()\r\n> {\r\n> \tvar obj = foo();\r\n> \tvar n1 = obj.f1();\r\n> \r\n> \tfunc test() {return 1000;}\r\n> \tInt.bind(\"test\", test);\r\n> \t\r\n> }\r\n"},"comment":{"url":"https://api.github.com/repos/marcobambini/gravity/issues/comments/292564547","html_url":"https://github.com/marcobambini/gravity/issues/123#issuecomment-292564547","issue_url":"https://api.github.com/repos/marcobambini/gravity/issues/123","id":292564547,"user":{"login":"blindfuzzy","id":18170510,"avatar_url":"https://avatars0.githubusercontent.com/u/18170510?v=3","gravatar_id":"","url":"https://api.github.com/users/blindfuzzy","html_url":"https://github.com/blindfuzzy","followers_url":"https://api.github.com/users/blindfuzzy/followers","following_url":"https://api.github.com/users/blindfuzzy/following{/other_user}","gists_url":"https://api.github.com/users/blindfuzzy/gists{/gist_id}","starred_url":"https://api.github.com/users/blindfuzzy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blindfuzzy/subscriptions","organizations_url":"https://api.github.com/users/blindfuzzy/orgs","repos_url":"https://api.github.com/users/blindfuzzy/repos","events_url":"https://api.github.com/users/blindfuzzy/events{/privacy}","received_events_url":"https://api.github.com/users/blindfuzzy/received_events","type":"User","site_admin":false},"created_at":"2017-04-07T15:14:14Z","updated_at":"2017-04-07T15:14:14Z","body":"@marcobambini this is the test case that is still causing the double free to occur. \r\n```\r\n#unittest {\r\n\tname: \"Bind/unbind test.\";\r\n\terror: NONE;\r\n\tresult: 61010;\r\n};\r\n\r\nclass foo {\r\n\tfunc f1() {return 10;}\r\n}\r\n\r\nfunc main() {\r\n\tvar obj = foo();\r\n\tvar n1 = obj.f1();// 10\r\n\t\r\n\tfunc test() {return 1000;}\r\n\tInt.bind(\"f2\", test);\r\n\tvar n2 = obj.f2();\t\t\t\t//0\r\n\t\r\n\tobj.bind(\"f3\", {return 10000;});\r\n\tvar n3 = obj.f3()\t// 10000\r\n\t\r\n\tobj.unbind(\"f2\");\r\n\tobj.bind(\"f2\", {return 50000;});\r\n\tvar n4 = obj.f2();// 5\r\n\t\r\n\treturn n1+n2+n3+n4;\r\n}\r\n```\r\n"}}
{"actor":{"display_login":"blindfuzzy"}}