emacs-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: CVE-2021-36699 report


From: tomas
Subject: Re: CVE-2021-36699 report
Date: Tue, 25 Apr 2023 08:37:32 +0200

On Mon, Apr 24, 2023 at 09:27:34PM +0000, fuomag9 wrote:
> Hi,
> 
> This email was forwarded to you as suggested by simon@josefsson.org 
> <mailto:simon@josefsson.org> as I was forwarded to this person when 
> contacting security@gnu.org
> 
> 
> 
> Hi,
> I’m a security researcher and I’ve searched for a way to contact the emacs 
> security team but I’ve not found any information online, so I’m reporting 
> this issue here.
> I’ve discovered a buffer overflow in GNU Emacs 28.0.50 (at the time of 
> writing the exploit still works on GNU Emacs 28.2)
> The issue is inside the --dump-file functionality of emacs, in particular 
> dump_make_lv_from_reloc at pdumper.c:5239
> Attached to this email there's is payload used to make the vulnerability work 
> (if emacs complains about a signature error you need to replace the hex bytes 
> inside the payload with the expected one, since every emacs binary will 
> expect a different signature).

[...]

Hm. The way I see this: the dump file is part of the
Emacs program. Creating a vulnerability by replacing
part of a program (e.g. a shared library) seems to be
possible everywhere, no?

Cheers
-- 
t

Attachment: signature.asc
Description: PGP signature


reply via email to

[Prev in Thread] Current Thread [Next in Thread]