Impact

Zydis users of versions v3.2.0 and older that use the string functions provided in zycore in order to append untrusted user data to the formatter buffer within their custom formatter hooks can run into heap buffer overflows.

Older versions of Zydis failed to properly initialize the string object within the formatter buffer, forgetting to initialize a few fields, leaving their value to chance. This could then in turn cause zycore functions like ZyanStringAppend to make incorrect calculations for the new target size, resulting in heap memory corruption.

This does not affect the regular uncustomized Zydis formatter, because Zydis internally doesn't use the string functions in zycore that act upon these fields. However, because the zycore string functions are the intended way to work with the formatter buffer for users of the library that wish to extend the formatter, we still consider this to be a vulnerability in Zydis.

Thank you to @geeknik who found this issues during fuzzing, providing us with a test case for reproducing it! For more details, please check out the links in the "References" section below.

Patches

This bug is patched on master (v4 development) and the fix was also back-ported to the v3 branch, maintenance/v3. The first tagged version containing this fix is v3.2.1.

Workarounds

Refrain from using zycore string functions in your formatter hooks until updating to a patched version.

References

https://huntr.dev/bounties/d2536d7d-36ce-4723-928c-98d1ee039784
https://huntr.dev/bounties/96b0a482-7041-45b1-9327-c6a4a8f32d3a

For more information

If you have any questions or comments about this advisory, please open an issue in this repository.