GNU bug report logs - #63063
CVE-2021-36699 report

Previous Next

Full log

Message #50 received at submit <at> debbugs.gnu.org (full text, mbox):

From: fuomag9 <fuo <at> fuo.fi>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: bug-gnu-emacs <at> gnu.org
Subject: Re: CVE-2021-36699 report
Date: Tue, 25 Apr 2023 08:45:06 +0000

[Message part 1 (text/plain, inline)]

Hi, the CVE is currently unpublished. So when visiting this URL you’ll see that it’s reserved https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=CVE-2021-36699


> On 25 Apr 2023, at 09:14, Eli Zaretskii <eliz <at> gnu.org> wrote:
> 
>> From: fuomag9 <fuo <at> fuo.fi>
>> Date: Mon, 24 Apr 2023 21:27:34 +0000
>> 
>> I’m a security researcher and I’ve searched for a way to contact the emacs security team but I’ve not found any information online, so I’m reporting this issue here.
>> I’ve discovered a buffer overflow in GNU Emacs 28.0.50 (at the time of writing the exploit still works on GNU Emacs 28.2)
>> The issue is inside the --dump-file functionality of emacs, in particular dump_make_lv_from_reloc at pdumper.c:5239
>> Attached to this email there's is payload used to make the vulnerability work (if emacs complains about a signature error you need to replace the hex bytes inside the payload with the expected one, since every emacs binary will expect a different signature).
>> This issue has been assigned CVE-2021-36699 and thus I’m notifying you of this. (I do not think the emacs team is aware of this security issue)
>> The POC is simple:
>> Launch emacs --dump-file exploit, where exploit is a custom crafted emacs dump file
> 
> Please tell more about the buffer overflow: where does it happen in
> the Emacs sources, which buffer overflows, and why.  I cannot find
> these details in your report.
> 
> Also, the CVE ID seems to be incorrect: if I look it up, I get some
> SQL related issue, not an Emacs issue.

[Message part 2 (text/html, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.