search

openwall / john

John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
https://www.openwall.com/john/
Other
10.05k stars 2.08k forks source link

--fuzz leaks memory in formats with `psalt->dsalt.salt_alloc_needs_free = 1` #5023

Open AlekseyCherepanov opened 2 years ago

AlekseyCherepanov commented 2 years ago

ASan reports leaks after --fuzzing format with dynamic salt allocation (#752).

I patched out most self tests in pkzip_fmt_plug.c, so only the last one is present. It is short and fuzzing finishes in 4 seconds. (Local paths are replaced by ....)

$ /usr/bin/time ./run/john --fuzz --format=pkzip
Fuzzing: PKZIP [32/64]...    Completed

All 1 formats passed fuzzing test!

=================================================================
==27080==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 386988 byte(s) in 271 object(s) allocated from:
    #0 0x7f8e3ac04518 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:95
    #1 0x56312e113172 in mem_calloc .../john/src/memory.c:107
    #2 0x56312e010988 in get_salt .../john/src/pkzip_fmt_plug.c:675
    #3 0x56312e0f9520 in ldr_load_pw_line .../john/src/loader.c:1045
    #4 0x56312e1991f6 in fuzz_test .../john/src/fuzz.c:586
    #5 0x56312e199760 in fuzz .../john/src/fuzz.c:689
    #6 0x56312e0ee3ab in john_run .../john/src/john.c:1672
    #7 0x56312e0ee3ab in main .../john/src/john.c:2082
    #8 0x7f8e3a16009a in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: 386988 byte(s) leaked in 271 allocation(s).
Command exited with non-zero status 1
3.51user 0.87system 0:04.44elapsed 98%CPU (0avgtext+0avgdata 612640maxresident)k
8inputs+1440outputs (0major+187626minor)pagefaults 0swaps

Same thing happens with 7z. It can finish in ~50 seconds without commenting out self-tests. But 7z requires fix for #4971. (I am about to send PR with it.)

Both formats do not leak in regular runs (both --test and real attacks). So I guess that's a problem with fuzzer.

Both formats have the following setting for salts:

psalt->dsalt.salt_alloc_needs_free = 1;

I did not test formats with different variants of the setting.

solardiz commented 2 years ago

Both formats do not leak in regular runs (both --test and real attacks). So I guess that's a problem with fuzzer.

Or maybe you were not loading many hashes in those real attacks, and there's a real leak per-hash.

Anyway, this is relatively unimportant. I'm not even sure how to label this issue.

AlekseyCherepanov commented 2 years ago

I guess I can dump all hashes with --fuzz-dump:

$ /usr/bin/time ./run/john --format=pkzip --fuzz-dump
Generating pwfile.PKZIP for PKZIP ... 277674426 bytes

Generated pwfile.<format> for 1 formats
1.65user 0.45system 0:02.11elapsed 99%CPU (0avgtext+0avgdata 195636maxresident)k
0inputs+542336outputs (0major+63863minor)pagefaults 0swaps

Then it finishes without leak.

$ /usr/bin/time ./run/john --format=pkzip pwfile.PKZIP --mask=1
Warning: invalid UTF-8 seen reading pwfile.PKZIP
Warning: check for duplicates partially bypassed to speedup loading
Using default input encoding: UTF-8
Loaded 1548 password hashes with 271 different salts (5.7x same-salt boost) (PKZIP [32/64])
Press Ctrl-C to abort, or send SIGUSR1 to john process for status
0g 0:00:00:00  0g/s 8.333p/s 2258c/s 12900C/s 1
Session completed. 
3.29user 0.53system 0:03.97elapsed 96%CPU (0avgtext+0avgdata 591372maxresident)k
0inputs+40outputs (0major+186464minor)pagefaults 0swaps

Attack without --mask=1 crashes... I'll make another issue.

AlekseyCherepanov commented 2 years ago

Sorry! I deleted comment sent onto wrong page.