Project

General

Profile

Bug #4357

Napatech memory corruption

Added by Jeff Lucovsky 4 months ago. Updated 4 months ago.

Status:
New
Priority:
Normal
Assignee:
-
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Needs backport to 5.0, Needs backport to 6.0

Description

Observed on a 5.0.4 Suricata system with ASAN enabled:

Feb 23 12:43:47 notice suricata: =================================================================
Feb 23 12:43:47 notice suricata: ==238699==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x628000013a00 at pc 0x55be71f10309 bp 0x7fa09efcd220 sp 0x7fa09efcd210
Feb 23 12:43:47 notice suricata: WRITE of size 8 at 0x628000013a00 thread T71 (CS)
Feb 23 12:43:48 notice suricata:     #0 0x55be71f10308 in StatsOutput /suricata/build/production/src/counters.c:717
Feb 23 12:43:48 notice suricata:     #1 0x55be71f10308 in StatsMgmtThread /suricata/build/production/src/counters.c:418
Feb 23 12:43:48 notice suricata:     #2 0x7fa0d865337d in start_thread /data/home/broala/appliance/pkgs/glibc/build/glibc-2.32/nptl/pthread_create.c:463
Feb 23 12:43:48 notice suricata:     #3 0x7fa0d6ad9c6e in clone (/lib/libc.so.6+0xf9c6e)
Feb 23 12:43:48 notice suricata:
Feb 23 12:43:48 notice suricata: 0x628000013a00 is located 0 bytes to the right of 14592-byte region [0x628000010100,0x628000013a00)
Feb 23 12:43:48 notice suricata: allocated by thread T71 (CS) here:
Feb 23 12:43:48 notice suricata:     #0 0x7fa0da0d6078 in __interceptor_calloc ../../../../gcc-7.3.0/libsanitizer/asan/asan_malloc_linux.cc:70
Feb 23 12:43:48 notice suricata:     #1 0x55be71f0f486 in StatsOutput /suricata/build/production/src/counters.c:647
Feb 23 12:43:48 notice suricata:     #2 0x55be71f0f486 in StatsMgmtThread /suricata/build/production/src/counters.c:418
Feb 23 12:43:48 notice suricata:     #3 0x7fa0d865337d in start_thread /data/home/broala/appliance/pkgs/glibc/build/glibc-2.32/nptl/pthread_create.c:463
Feb 23 12:43:48 notice suricata:
Feb 23 12:43:48 notice suricata: Thread T71 (CS) created by T0 (Suricata-Main) here:
Feb 23 12:43:48 notice suricata:     #0 0x7fa0da02f06f in __interceptor_pthread_create ../../../../gcc-7.3.0/libsanitizer/asan/asan_interceptors.cc:243
Feb 23 12:43:48 notice suricata:     #1 0x55be722894c8 in TmThreadSpawn /suricata/build/production/src/tm-threads.c:1902
Feb 23 12:43:48 notice suricata:     #2 0x55be71f11627 in StatsSpawnThreads /suricata/build/production/src/counters.c:925
Feb 23 12:43:48 notice suricata:     #3 0x55be721e7a22 in RunModeDispatch /suricata/build/production/src/runmodes.c:393
Feb 23 12:43:48 notice suricata:     #4 0x55be71de2727 in main /suricata/build/production/src/suricata.c:3092
Feb 23 12:43:48 notice suricata:     #5 0x7fa0d6a0263c in __libc_start_main ../csu/libc-start.c:314
Feb 23 12:43:48 notice suricata:
Feb 23 12:43:48 notice suricata: SUMMARY: AddressSanitizer: heap-buffer-overflow /data/jal/appliance/pkgs/suricata/build/production/src/counters.c:717 in StatsOutput
Feb 23 12:43:48 notice suricata: Shadow bytes around the buggy address:
Feb 23 12:43:48 notice suricata:   0x0c507fffa6f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Feb 23 12:43:48 notice suricata:   0x0c507fffa700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Feb 23 12:43:48 notice suricata:   0x0c507fffa710: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Feb 23 12:43:48 notice suricata:   0x0c507fffa720: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Feb 23 12:43:48 notice suricata:   0x0c507fffa730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Feb 23 12:43:48 notice suricata: =>0x0c507fffa740:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Feb 23 12:43:48 notice suricata:   0x0c507fffa750: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Feb 23 12:43:48 notice suricata:   0x0c507fffa760: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Feb 23 12:43:48 notice suricata:   0x0c507fffa770: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Feb 23 12:43:48 notice suricata:   0x0c507fffa780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Feb 23 12:43:48 notice suricata:   0x0c507fffa790: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Feb 23 12:43:48 notice suricata: Shadow byte legend (one shadow byte represents 8 application bytes):
Feb 23 12:43:48 notice suricata:   Addressable:           00
Feb 23 12:43:48 notice suricata:   Partially addressable: 01 02 03 04 05 06 07
Feb 23 12:43:48 notice suricata:   Heap left redzone:       fa
Feb 23 12:43:48 notice suricata:   Freed heap region:       fd
Feb 23 12:43:48 notice suricata:   Stack left redzone:      f1
Feb 23 12:43:48 notice suricata:   Stack mid redzone:       f2
Feb 23 12:43:48 notice suricata:   Stack right redzone:     f3
Feb 23 12:43:48 notice suricata:   Stack after return:      f5
Feb 23 12:43:48 notice suricata:   Stack use after scope:   f8
Feb 23 12:43:48 notice suricata:   Global redzone:          f9
Feb 23 12:43:48 notice suricata:   Global init order:       f6
Feb 23 12:43:48 notice suricata:   Poisoned by user:        f7
Feb 23 12:43:48 notice suricata:   Container overflow:      fc
Feb 23 12:43:48 notice suricata:   Array cookie:            ac
Feb 23 12:43:48 notice suricata:   Intra object redzone:    bb
Feb 23 12:43:48 notice suricata:   ASan internal:           fe
Feb 23 12:43:48 notice suricata:   Left alloca redzone:     ca
Feb 23 12:43:48 notice suricata:   Right alloca redzone:    cb
Feb 23 12:43:48 notice suricata: ==238699==ABORTING 

#1

Updated by Victor Julien 4 months ago

  • Affected Versions 5.0.5, 6.0.1, git master added
  • Affected Versions deleted (7.0rc1)

Also available in: Atom PDF