Heap-based buffer overread (off-by-one) #11
Loading…
Reference in New Issue
Block a user
No description provided.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
CVE Reporting (2018-12-27) reporter
Function uncompress_nlabel that uncompresses mDNS nlabels goes outside data buffer - offset variables (off and p, p2) go outside size of input buffer (pkt_len). Risk of this issue is reduced, because it is possible to only read 1 byte over the buffer, and it is very unlikely that this will lead to crash.
Proposed CVSS 3.0 score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (3.7 Low)
Vulnerable lines: mdns.c:234
IS:
for (p = pkt_buf + off; p && p < e; p++) {SHOULD BE:
for (p = pkt_buf + off; p+1 < e && p; p++) {mdns.c:252
IS:
for (p = pkt_buf + off; *p && p < e; p++) {SHOULD BE:
for (p = pkt_buf + off; p+1 < e && *p; p++) {Packet that triggers this issue: crash_006_uncompress_nlabel.raw
Mitigation : While parsing the input buffer current offset should be checked and return with error when pkt_len is reached. Please take a look at patch that was produced to fix this issues in TizenRT (that uses tinysvcmdns):
2d9a3f156fCrash details using Address Sanitizer:
crash_006_uncompress_nlabel.raw