Fuzz and strings

The strings utility is commonly used to scan binary files for "interesting" strings. But, as Michał Zalewski found out when fuzz testing the tool, it does a lot more than just loop through the file looking for bytes of interest (e.g. ASCII). In fact, by default it does so much more that scanning random files with strings is seriously contraindicated.

One of the more frequent uses for strings is to scan binaries from various potentially dodgy sites to check for the presence of certain code (say, GPL-covered code), undocumented options, or other bits buried in the binary. But, as Zalewski showed, that could directly lead to code execution—probably not what the investigator intended. The problem stems from the fact that, by default, strings tries to be "helpful" by using other tools at its disposal—but it turns out, those tools are rather more dangerous as well.

strings comes from the GNU binutils project, which also provides the "Binary File Descriptor" library (libbfd). That library is used by several tools in binutils to tease apart various object file formats into an abstract representation. When strings detects an executable or object file in a format understood by libbfd, it uses the library to only search those pieces that might contain strings of interest. Unfortunately, libbfd appears to have some serious flaws in parsing the format of some object files, which can lead to exploitable crashes.

When running his american fuzzy lop (afl) fuzzer, Zalewski found "a range of troubling and likely exploitable out-of-bounds crashes due to very limited range checking". He went on to show an example where the code reads and writes using an attacker-controlled pointer, which is a recipe for code execution. In addition, he said that many Linux distributions do not build strings with address-space layout randomization (ASLR), making attacks using strings even easier. For example, many binaries in Fedora are not built as position-independent executables (PIEs), which is what allows ASLR. Fedora doesn't build PIEs for everything because of the extra overhead in executing an ASLR-protected binary. Network-facing programs (e.g. sshd), however, are shipped with ASLR protection.

Any attack requires somehow convincing the victim to run strings on a crafted binary file; that could result in the compromise of the account used to run the program, which is presumably—hopefully—not root. Using the -a (or --all) switch for strings will revert its behavior to what folks arguably expect: a simple loop through the binary looking for consecutive bytes of interest. That is unlikely to lead to any kind of compromise. Zalewski suggested that distributions may want to consider making strings -a the default in the future.

Other tools in binutils (e.g. objdump, readelf) may also suffer from similar problems, as they use libbfd too. Users of those tools may be a bit more aware that they are taking some risk when running them on random, possibly attacker-controlled binaries, however. The comments on the post indicate that GDB may also be vulnerable since it uses libbfd as well.

Zalewski reported the problem to the binutils project, leading to some fixes, though there has not been a new binutils release—at least yet. Interestingly, Tavis Ormandy found a related bug all the way back in 2005.

In an aside, Zalewski noted that he did the fuzzing on his matchbox-sized 10-core fuzzing cluster. That report compares the price-performance tradeoffs for several different fuzzing platforms (e.g. "cloud", virtual private server, his Intel Edison cluster). With luck, that may help lead others to start doing more focused fuzzing of our tools.