search

cbuchner1 / CudaMiner

a CUDA accelerated litecoin mining application based on pooler's CPU miner
Other
687 stars 304 forks source link

Security: risk of buffer overflow in submit_upstream_work #150

Open pascal-cuoq opened 9 years ago

pascal-cuoq commented 9 years ago

In submit_upstream_work, line 452 : 

        sprintf(s,
            "{\"method\": \"mining.submit\", \"params\": [\"%s\", \"%s\", \"%s\", \"%s\", \"%s\"], \"id\":4}",
            pool->user, work->job_id, xnonce2str, ntimestr, noncestr);

The variable s indicates a stack-allocated buffer of a fixed size. Also work->job_id, one of the dangerous-looking arguments, comes straight from the server and I did not see anything that would limit its size (*).

The other dangerous-looking argument is xnonce2str, which has a dynamic size in work->xnonce2_len.

This was fixed in pooler-cpuminer with the following commit. The vulnerability appears to have first been reported here.