Debian Bug report logs - #792420
zsnes: emulator escape vulnerability

Display info messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Paul Wise <pabs@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: zsnes: emulator escape vulnerability

Date: Wed, 15 Jul 2015 00:14:09 +0800

[Message part 1 (text/plain, inline)]

Package: zsnes
Severity: important
Tags: security
X-Debbugs-CC: security@debian.org, sergio_br2@yahoo.com.br

According to this Youtube video and forum post, there are at least 3
vulnerabilities in zsnes that allow ROMs to escape the zsnes emulator
and execute arbitrary code on the host running zsnes. The known issues
will be fixed in 1.52 but there may be more issues. This may or may not
be related to the cppcheck warnings from bug #610313.

https://www.youtube.com/watch?v=Q3SOYneC7mU
http://www.smwcentral.net/?p=viewthread&t=79058
https://bugs.debian.org/610313

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 792420@bugs.debian.org (full text, mbox, reply):

From: Etienne Millon <me@emillon.org>

To: Paul Wise <pabs@debian.org>, 792420@bugs.debian.org

Subject: Re: Bug#792420: zsnes: emulator escape vulnerability

Date: Tue, 14 Jul 2015 18:57:02 +0200

[Message part 1 (text/plain, inline)]

* Paul Wise <pabs@debian.org> [150714 18:20]:
> According to this Youtube video and forum post, there are at least 3
> vulnerabilities in zsnes that allow ROMs to escape the zsnes
> emulator and execute arbitrary code on the host running zsnes. The
> known issues will be fixed in 1.52 but there may be more issues.
> This may or may not be related to the cppcheck warnings from bug
> #610313.

Thanks for the report.

While neither the exploit code nor a fix is out, I believe that the
best course of action is indeed to write a patch for #610313.

It may also be possible that due to hardening patches, this bug is not
exploitable in Debian.

-- 
Etienne Millon

[signature.asc (application/pgp-signature, inline)]

Message #15 received at 792420@bugs.debian.org (full text, mbox, reply):

From: Alfred Agrell <alfred@agrell.info>

To: 792420@bugs.debian.org, 792420-subscribe@bugs.debian.org

Subject: Re: Bug#792420: zsnes: emulator escape vulnerability

Date: Tue, 14 Jul 2015 21:03:04 +0200

On Tue, 14 Jul 2015 18:57:02 +0200 Etienne Millon <me@emillon.org> wrote:
> * Paul Wise <pabs@debian.org> [150714 18:20]:
> > According to this Youtube video and forum post, there are at least 3
> > vulnerabilities in zsnes that allow ROMs to escape the zsnes
> > emulator and execute arbitrary code on the host running zsnes. The
> > known issues will be fixed in 1.52 but there may be more issues.
> > This may or may not be related to the cppcheck warnings from bug
> > #610313.
>
> Thanks for the report.
>
> While neither the exploit code nor a fix is out, I believe that the
> best course of action is indeed to write a patch for #610313.
>
> It may also be possible that due to hardening patches, this bug is not
> exploitable in Debian.
>
> --
> Etienne Millon

I am the one who created that PoC, so I know all relevant facts about 
these vulns.

#610313 is irrelevant, these vulns are all in assembly. Whatever 
hardening you're thinking of is also insufficient, there isn't even any 
ASLR in this program.


The three aforementioned vulns (along with something in the C code, not 
sure if it's exploitable) are patched upstream:

http://svn.zsnes.com/comp.php?repname=zsnes&path=%2F&compare[]=%2F@5307&compare[]=%2F@5308
http://svn.zsnes.com/comp.php?repname=zsnes&path=%2F&compare[]=%2F@5310&compare[]=%2F@5311


There is also a fourth vuln that they didn't patch yet:

http://svn.zsnes.com/filedetails.php?repname=zsnes&path=%2Ftrunk%2Fsrc%2Fcpu%2Fspc700.asm&rev=4492&sc=1

Op4E should use SPCRAM, not [spcRamDP]. This leads to an exploitable 
buffer overflow.


Vuln 5: A crafted savestate can set wramrwadr to something impossible, 
leading to yet another exploitable overflow.


And yes, it is very likely that more exploits exist. ZSNES is an 
enormous pile of decades-old code, written more for performance than 
security and correctness. I'm surprised they've remained hidden for so long.

Message #20 received at 792420@bugs.debian.org (full text, mbox, reply):

From: Paul Wise <pabs@debian.org>

To: Etienne Millon <me@emillon.org>, 792420@bugs.debian.org, sergio_br2 <sergio_br2@yahoo.com.br>

Subject: Re: Bug#792420: zsnes: emulator escape vulnerability

Date: Wed, 15 Jul 2015 11:16:57 +0800

[Message part 1 (text/plain, inline)]

On Tue, 2015-07-14 at 18:57 +0200, Etienne Millon wrote:

> While neither the exploit code nor a fix is out, I believe that the
> best course of action is indeed to write a patch for #610313.

Sergio confirmed with the author that the issues are not in the C code
but in the assembly, from the #debian-games IRC channel:

<sergio-br2> <Alcaro> not cppcheck, that's for sure, these are all in assembly.

> It may also be possible that due to hardening patches, this bug is not
> exploitable in Debian.

Seems unlikely given the above.

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[signature.asc (application/pgp-signature, inline)]

Message #25 received at 792420@bugs.debian.org (full text, mbox, reply):

From: PT FINDORA INTERNUSA <sankhokaihatsuco.ltd@outlook.com>

To: me <marketing01@findora.com>

Subject: P.O 22/09/2021

Date: Tue, 21 Sep 2021 21:16:24 -0700

[Message part 1 (text/plain, inline)]

Hello,

Good morning,

We have gone through your samples from a partner and Here is our  Order 
List. Please do bear in mind that we are very much in  need of this 
order, quote your competitive prices.

Kindly send the Order confirmation.

Your early reply will be much appreciated.

Best Regards,

Maryanah Erwin.

PT FINDORA INTERNUSA

Jln Pahlawan 66 Kec. Arjawinangun

45162 CIREBON West-Java INDONESIA

tel : +62 231 357334

fax: +62 231 357260

email: marketing@findora.com

[P.O22.09.2021.cab (application/zip, attachment)]

Message #30 received at 792420-done@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 510238-done@bugs.debian.org,544313-done@bugs.debian.org,609524-done@bugs.debian.org,610313-done@bugs.debian.org,680073-done@bugs.debian.org,727781-done@bugs.debian.org,792420-done@bugs.debian.org,1038482-done@bugs.debian.org,1039564-done@bugs.debian.org,

Cc: zsnes@packages.debian.org

Subject: Bug#1039568: Removed package(s) from unstable

Date: Wed, 28 Jun 2023 15:26:04 +0000

Version: 1.510+bz2-10.2+rm

Dear submitter,

as the package zsnes has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/1039568

The version of this package that was in Debian prior to this removal
can still be found using https://snapshot.debian.org/.

Please note that the changes have been done on the master archive and
will not propagate to any mirrors until the next dinstall run at the
earliest.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)

Send a report that this bug log contains spam.