Description: Xfce Thunar 1.6.15, when Xfce 4.12 is used, mishandles the IBus-Unikey input method for file searches within File Manager, leading to an out-of-bounds read and SEGV. This could potentially be exploited by an arbitrary local user who creates files in /tmp before the victim uses this input method.
Additional Information:
VirtualBox POC: https://drive.google.com/open?id=1MMjgybKioy2evO8ywzderTT60MwjA11Z
Core Dump: https://drive.google.com/open?id=1Vz3rezkQiOf_b-q6x3RZ7C4nSkje9GhU
Stack trace:
> gdb-peda$ run
> Starting program: /tmp/thunar
>
> Thread debugging using libthread_db enabled
>
> Using host libthread_db library "/usr/lib/libthread_db.so.1".
> [New Thread 0x7fffed6c9700 (LWP 3439)]
> [New Thread 0x7fffecec8700 (LWP 3440)]
> [New Thread 0x7fffe7b8f700 (LWP 3441)]
> [New Thread 0x7fffe738e700 (LWP 3442)]
>
> (thunar:3438): Gdk-WARNING **: gdk_window_set_icon_list: icons too large
>
> Thread 0x7fffe738e700 (LWP 3442) exited
>
> Thread 1 "thunar" received signal SIGSEGV, Segmentation fault.
>
> RAX: 0x7400000061 ('a')
> RBX: 0x0
> RCX: 0x7fffffffce90 --> 0x5555558a41e0 --> 0x4
> RDX: 0x555555892490 --> 0x55555589b9a0 --> 0x55555589b800 --> 0x2
> RSI: 0x555555aebbf0 --> 0x555555aa0061 --> 0x0
> RDI: 0x5555559d13f0 --> 0x5555558a2740 --> 0x5555558a41e0 --> 0x4
> RBP: 0x555555aa19f0 --> 0x40000002
> RSP: 0x7fffffffccc8 --> 0x7ffff4e06c5d (<g_closure_invoke+413>: mov rax,QWORD PTR [rbp+0x0])
> RIP: 0x7ffff79a1fb4 (mov edi,DWORD PTR [rax+0x154])
> R8 : 0x7fffffffce10 --> 0x135
> R9 : 0x0
> R10: 0x555555804758 --> 0x700070 ('p')
> R11: 0x7fffffffd060 --> 0x3000000020 (' ')
> R12: 0x2
> R13: 0x7fffffffce90 --> 0x5555558a41e0 --> 0x4
> R14: 0x7fffffffce10 --> 0x135
> R15: 0x7ffff6a32770 (<g_cclosure_marshal_VOID__STRING>: cmp edx,0x2)
> EFLAGS: 0x10202 (carry parity adjust zero sign trap INTERRUPT direction overflow)
>
> 0x7ffff79a1fa1: call QWORD PTR [rip+0x229919] # 0x7ffff7bcb8c0
> 0x7ffff79a1fa7: nop WORD PTR [rax+rax*1+0x0]
> 0x7ffff79a1fb0: mov rax,QWORD PTR [rsi+0x70]
> => 0x7ffff79a1fb4: mov edi,DWORD PTR [rax+0x154]
> 0x7ffff79a1fba: or BYTE PTR [rax+0x148],0x2
> 0x7ffff79a1fc
VulnerabilityType
Out of Bound
Vendor of Product
XFCE
Affected Product Code Base
Thunar – < 1.6.15 and Xfce < 4.12
Reference
Exploit:
Discoverer
0xd0ff9
0xD0ff9 