Forest Global Training Partners

Cyber Risks · Cisco Talos

Crashing Stacks Without Squishing Bugs: Advanced Vulnerability Analysis

Summary: Cisco Talos researchers Marcin Noga and Holger Unterbrink walk through debugging two Lexmark Perceptive Document Filters code execution vulnerabilities, using gdb with PEDA, valgrind, and the reverse-execution debugger rr to trace stack and heap corruption back to its source. In the first case, rr's reverse-stepi and a hardware watchpoint on a stack address showed the return address was overwritten inside memcpy reached via ISYS_NS::CPagedMemoryStream::Read, with a size argument of 0x400; in the second, heap instrumentation via GFlags or libduma and an allocation tracing script located a zero-size allocation in ISYS_NS::docfile::CIStorageBase::Resolve_Short_Sectors.

Bottom line: The root causes sit in document-parsing code from a widely deployed filter library, and the write-ups show the overflow is driven by size values read from the file itself - meaning the malicious input arrives as an ordinary document.

Read the original at Cisco Talos ↗

Topics
Malware
Related