Use After Free vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the do_directive function in the modules/preprocs/nasm/nasm-pp.c component.
cpe:2.3:a:yasm_project:yasm:1.3.0.86.g9def:*:*:*:*:*:*:*
C9D63BD2-36F6-440B-AC78-6F48EDDC12CD
OR
**The name of an affected Product**
[yasm](https://github.com/yasm/yasm)

**The affected version**
Commit: [9defefa](https://github.com/yasm/yasm/commit/9defefae9fbcb6958cddbfa778c1ea8605da8b8b)
yasm 1.3.0.86.g9def

**Description**
An issue in yasm 1.3.0.86.g9def allows a attacker to cause a denial of service via the do_directive function in the
modules/preprocs/nasm/nasm-pp.c component.

**Vulnerability Type**
Use After Free

**Environment**
- Operating System
````
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.6 LTS
Release:        18.04
Codename:       bionic
````
- Compiler
````
Ubuntu clang version 12.0.1-++20211102090516+fed41342a82f-1~exp1~20211102211019.11
Target: x86_64-pc-linux-gnu
Thread model: posix
````

**Steps to Reproduce**
download [poc.zip](https://github.com/yasm/yasm/files/13415757/poc.zip), then
````
git clone https://github.com/yasm/yasm
cd yasm
git checkout 9defefa
./autogen.sh
make distclean
CC=clang \
    CXX=clang++ \
    CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
    CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
    ./configure
make -j $(nproc)
unzip poc.zip 
# run command
./yasm poc
````

**ASAN info**
````
yasm: file name already has no extension: output will be in `yasm.out'
=================================================================
==4513==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e0000011f0 at pc 0x00000056e946 bp 0x7fff5a439c10 sp 0x7fff5a439c08
READ of size 4 at 0x60e0000011f0 thread T0
    #0 0x56e945 in do_directive /yasm/modules/preprocs/nasm/nasm-pp.c:2389:38
    #1 0x5685dc in pp_getline /yasm/modules/preprocs/nasm/nasm-pp.c:5084:13
    #2 0x56151b in nasm_preproc_get_line /yasm/modules/preprocs/nasm/nasm-preproc.c:203:12
    #3 0x551395 in nasm_parser_parse /yasm/modules/parsers/nasm/nasm-parse.c:219:13
    #4 0x550fdf in nasm_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:66:5
    #5 0x550985 in nasm_parser_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:83:5
    #6 0x4ca7d6 in do_assemble /yasm/frontends/yasm/yasm.c:641:5
    #7 0x4c832e in main /yasm/frontends/yasm/yasm.c:877:12
    #8 0x7f7cd4d0dc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #9 0x41b9c9 in _start (/yasm/yasm+0x41b9c9)

0x60e0000011f0 is located 48 bytes inside of 160-byte region [0x60e0000011c0,0x60e000001260)
freed by thread T0 here:
    #0 0x496622 in free (/yasm/yasm+0x496622)
    #1 0x515814 in def_xfree /yasm/libyasm/xmalloc.c:113:5
    #2 0x56a089 in free_mmacro /yasm/modules/preprocs/nasm/nasm-pp.c:1163:5
    #3 0x567bc7 in pp_getline /yasm/modules/preprocs/nasm/nasm-pp.c:5010:25
    #4 0x56151b in nasm_preproc_get_line /yasm/modules/preprocs/nasm/nasm-preproc.c:203:12
    #5 0x551395 in nasm_parser_parse /yasm/modules/parsers/nasm/nasm-parse.c:219:13
    #6 0x550fdf in nasm_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:66:5
    #7 0x550985 in nasm_parser_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:83:5
    #8 0x4ca7d6 in do_assemble /yasm/frontends/yasm/yasm.c:641:5
    #9 0x4c832e in main /yasm/frontends/yasm/yasm.c:877:12
    #10 0x7f7cd4d0dc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310

previously allocated by thread T0 here:
    #0 0x49688d in malloc (/yasm/yasm+0x49688d)
    #1 0x5156c7 in def_xmalloc /yasm/libyasm/xmalloc.c:69:14
    #2 0x57649d in do_directive /yasm/modules/preprocs/nasm/nasm-pp.c:3212:24
    #3 0x5685dc in pp_getline /yasm/modules/preprocs/nasm/nasm-pp.c:5084:13
    #4 0x56151b in nasm_preproc_get_line /yasm/modules/preprocs/nasm/nasm-preproc.c:203:12
    #5 0x551395 in nasm_parser_parse /yasm/modules/parsers/nasm/nasm-parse.c:219:13
    #6 0x550fdf in nasm_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:66:5
    #7 0x550985 in nasm_parser_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:83:5
    #8 0x4ca7d6 in do_assemble /yasm/frontends/yasm/yasm.c:641:5
    #9 0x4c832e in main /yasm/frontends/yasm/yasm.c:877:12
    #10 0x7f7cd4d0dc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-use-after-free /yasm/modules/preprocs/nasm/nasm-pp.c:2389:38 in do_directive
Shadow bytes around the buggy address:
  0x0c1c7fff81e0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff81f0: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
  0x0c1c7fff8200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff8210: 00 00 00 00 fa fa fa fa fa fa fa fa 00 00 00 00
  0x0c1c7fff8220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c1c7fff8230: fa fa fa fa fa fa fa fa fd fd fd fd fd fd[fd]fd
  0x0c1c7fff8240: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
  0x0c1c7fff8250: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c1c7fff8260: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c1c7fff8270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff8280: 00 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==4513==ABORTING
````
heap-use-after-free in the function do_directive() at modules/preprocs/nasm/nasm-pp.c:2389
This is a GitHub Issue
repo:yasm
owner:yasm
Title : heap-use-after-free in the function do_directive() at modules/preprocs/nasm/nasm-pp.c:2389
Issue date:

--- start body ---
**The name of an affected Product**
[yasm](https://github.com/yasm/yasm)

**The affected version**
Commit: [9defefa](https://github.com/yasm/yasm/commit/9defefae9fbcb6958cddbfa778c1ea8605da8b8b)
yasm 1.3.0.86.g9def

**Description**
An issue in yasm 1.3.0.86.g9def allows a attacker to cause a denial of service via the do_directive function in the
modules/preprocs/nasm/nasm-pp.c component.

**Vulnerability Type**
Use After Free

**Environment**
- Operating System
````
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.6 LTS
Release:        18.04
Codename:       bionic
````
- Compiler
````
Ubuntu clang version 12.0.1-++20211102090516+fed41342a82f-1~exp1~20211102211019.11
Target: x86_64-pc-linux-gnu
Thread model: posix
````

**Steps to Reproduce**
download [poc.zip](https://github.com/yasm/yasm/files/13415757/poc.zip), then
````
git clone https://github.com/yasm/yasm
cd yasm
git checkout 9defefa
./autogen.sh
make distclean
CC=clang \
    CXX=clang++ \
    CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
    CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
    ./configure
make -j $(nproc)
unzip poc.zip 
# run command
./yasm poc
````

**ASAN info**
````
yasm: file name already has no extension: output will be in `yasm.out'
=================================================================
==4513==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e0000011f0 at pc 0x00000056e946 bp 0x7fff5a439c10 sp 0x7fff5a439c08
READ of size 4 at 0x60e0000011f0 thread T0
    #0 0x56e945 in do_directive /yasm/modules/preprocs/nasm/nasm-pp.c:2389:38
    #1 0x5685dc in pp_getline /yasm/modules/preprocs/nasm/nasm-pp.c:5084:13
    #2 0x56151b in nasm_preproc_get_line /yasm/modules/preprocs/nasm/nasm-preproc.c:203:12
    #3 0x551395 in nasm_parser_parse /yasm/modules/parsers/nasm/nasm-parse.c:219:13
    #4 0x550fdf in nasm_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:66:5
    #5 0x550985 in nasm_parser_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:83:5
    #6 0x4ca7d6 in do_assemble /yasm/frontends/yasm/yasm.c:641:5
    #7 0x4c832e in main /yasm/frontends/yasm/yasm.c:877:12
    #8 0x7f7cd4d0dc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #9 0x41b9c9 in _start (/yasm/yasm+0x41b9c9)

0x60e0000011f0 is located 48 bytes inside of 160-byte region [0x60e0000011c0,0x60e000001260)
freed by thread T0 here:
    #0 0x496622 in free (/yasm/yasm+0x496622)
    #1 0x515814 in def_xfree /yasm/libyasm/xmalloc.c:113:5
    #2 0x56a089 in free_mmacro /yasm/modules/preprocs/nasm/nasm-pp.c:1163:5
    #3 0x567bc7 in pp_getline /yasm/modules/preprocs/nasm/nasm-pp.c:5010:25
    #4 0x56151b in nasm_preproc_get_line /yasm/modules/preprocs/nasm/nasm-preproc.c:203:12
    #5 0x551395 in nasm_parser_parse /yasm/modules/parsers/nasm/nasm-parse.c:219:13
    #6 0x550fdf in nasm_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:66:5
    #7 0x550985 in nasm_parser_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:83:5
    #8 0x4ca7d6 in do_assemble /yasm/frontends/yasm/yasm.c:641:5
    #9 0x4c832e in main /yasm/frontends/yasm/yasm.c:877:12
    #10 0x7f7cd4d0dc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310

previously allocated by thread T0 here:
    #0 0x49688d in malloc (/yasm/yasm+0x49688d)
    #1 0x5156c7 in def_xmalloc /yasm/libyasm/xmalloc.c:69:14
    #2 0x57649d in do_directive /yasm/modules/preprocs/nasm/nasm-pp.c:3212:24
    #3 0x5685dc in pp_getline /yasm/modules/preprocs/nasm/nasm-pp.c:5084:13
    #4 0x56151b in nasm_preproc_get_line /yasm/modules/preprocs/nasm/nasm-preproc.c:203:12
    #5 0x551395 in nasm_parser_parse /yasm/modules/parsers/nasm/nasm-parse.c:219:13
    #6 0x550fdf in nasm_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:66:5
    #7 0x550985 in nasm_parser_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:83:5
    #8 0x4ca7d6 in do_assemble /yasm/frontends/yasm/yasm.c:641:5
    #9 0x4c832e in main /yasm/frontends/yasm/yasm.c:877:12
    #10 0x7f7cd4d0dc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-use-after-free /yasm/modules/preprocs/nasm/nasm-pp.c:2389:38 in do_directive
Shadow bytes around the buggy address:
  0x0c1c7fff81e0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff81f0: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
  0x0c1c7fff8200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff8210: 00 00 00 00 fa fa fa fa fa fa fa fa 00 00 00 00
  0x0c1c7fff8220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c1c7fff8230: fa fa fa fa fa fa fa fa fd fd fd fd fd fd[fd]fd
  0x0c1c7fff8240: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
  0x0c1c7fff8250: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c1c7fff8260: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c1c7fff8270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff8280: 00 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==4513==ABORTING
````
--- end body ---

comments :
--- start comments ---

--- end comments ---