search

irontec / sngrep

Ncurses SIP Messages flow viewer
GNU General Public License v3.0
1.02k stars 187 forks source link

[bug] sngrep stack buffer overflow #430

Closed randomssr closed 1 year ago

randomssr commented 1 year ago

I found a stack buffer overflow in sngrep. Please confirm. Thanks!

Test Environment Ubuntu 20.04, 64 bit sngrep (version: v1.6.0 ;5089514)

How to trigger Compile the program with AddressSanitizer Run command $ ./sngrep -N -R -I $PoC Details ASAN report $./sngrep -N -R -I $PoC 

Dialog count: 0=================================================================
==974123==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fda5fffe9a0 at pc 0x00000049b787 bp 0x7fda5fff98d0 sp 0x7fda5fff9098
READ of size 57344 at 0x7fda5fffe9a0 thread T1
    #0 0x49b786 in __asan_memcpy (/home/root/randomFuzz/sngrep/sngrep/sngrep_N_R_I/sngrep+0x49b786)
    #1 0x4dc7f1 in packet_set_payload /home/root/FuzzDateset/sngrep/sngrep-1.6.0/src/packet.c:147:9
    #2 0x4d1697 in parse_packet /home/root/FuzzDateset/sngrep/sngrep-1.6.0/src/capture.c:430:9
    #3 0x7fda61bad466  (/lib/x86_64-linux-gnu/libpcap.so.0.8+0x23466)
    #4 0x7fda61b9bf67 in pcap_loop (/lib/x86_64-linux-gnu/libpcap.so.0.8+0x11f67)
    #5 0x4cf5c9 in capture_thread /home/root/FuzzDateset/sngrep/sngrep-1.6.0/src/capture.c:1042:5
    #6 0x7fda61b6d608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
    #7 0x7fda61918132 in __clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Address 0x7fda5fffe9a0 is located in stack of thread T1 at offset 20512 in frame
    #0 0x4d067f in parse_packet /home/root/FuzzDateset/sngrep/sngrep-1.6.0/src/capture.c:321

  This frame has 3 object(s):
    [32, 20512) 'data' (line 333)
    [20768, 20772) 'size_capture' (line 337) <== Memory access at offset 20512 partially underflows this variable
    [20784, 20788) 'size_payload' (line 339) <== Memory access at offset 20512 partially underflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
Thread T1 created by T0 here:
    #0 0x486a8c in pthread_create (/home/root/randomFuzz/sngrep/sngrep/sngrep_N_R_I/sngrep+0x486a8c)
    #1 0x4d712c in capture_launch_thread /home/root/FuzzDateset/sngrep/sngrep-1.6.0/src/capture.c:1027:13
    #2 0x4efb9e in main /home/root/FuzzDateset/sngrep/sngrep-1.6.0/src/main.c:433:9
    #3 0x7fda6181d082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: stack-buffer-overflow (/home/root/randomFuzz/sngrep/sngrep/sngrep_N_R_I/sngrep+0x49b786) in __asan_memcpy
Shadow bytes around the buggy address:
  0x0ffbcbff7ce0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ffbcbff7cf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ffbcbff7d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ffbcbff7d10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ffbcbff7d20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0ffbcbff7d30: 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
  0x0ffbcbff7d40: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
  0x0ffbcbff7d50: f2 f2 f2 f2 04 f2 04 f3 00 00 00 00 00 00 00 00
  0x0ffbcbff7d60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ffbcbff7d70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ffbcbff7d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==974123==ABORTING

The URL of PoC is PoC

Kaian commented 1 year ago

Hi!

I can confirm this issue. Above commit should get rid of it.

Thanks for the bugreport!

Shadow0x001 commented 1 year ago

Hello, I hope you're doing well,

When I use this POC it's not give me the same result. you @Kaian can shear whit us the result after this POC Thank you!

randomssr commented 1 year ago

I reproduced the vulnerability with the following command： sngrep:v1.6.0

CC=gcc CXX=g++ CFLAGS="-g -fsanitize=address" CXXFLAGS="-g -fsanitize=address" ./configure make I can get the above results. This stack-buffer-overflow bug happens in capture.c:147. The program does not check the length of "payload".

Kaian commented 1 year ago

When I use this POC it's not give me the same result. you @Kaian can shear whit us the result after this POC

Sure!

Before 038a658

➜  # CC=gcc CXX=g++ CFLAGS="-g -fsanitize=address" CXXFLAGS="-g -fsanitize=address" ./configure
➜  # make
➜  # src/sngrep -N -R -I ~/Downloads/id0-stack-overflow 
Dialog count: 0=================================================================
==10730==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fa3ad404040 at pc 0x7fa3b1461013 bp 0x7fa3addf9ae0 sp 0x7fa3addf9288
READ of size 57344 at 0x7fa3ad404040 thread T1
    #0 0x7fa3b1461012 in __interceptor_memcpy /usr/src/debug/gcc/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:899
    #1 0x5558a72925cb in packet_set_payload /home/kaian/Projects/sngrep/src/packet.c:147
    #2 0x5558a728bc74 in parse_packet /home/kaian/Projects/sngrep/src/capture.c:430
    #3 0x7fa3b1b7f8d2  (/usr/lib/libpcap.so.1+0x2c8d2) (BuildId: b1d10ed2f42804ba91995b233589e17e715d4218)
    #4 0x7fa3b1b60b96 in pcap_loop (/usr/lib/libpcap.so.1+0xdb96) (BuildId: b1d10ed2f42804ba91995b233589e17e715d4218)
    #5 0x5558a728f15a in capture_thread /home/kaian/Projects/sngrep/src/capture.c:1042
    #6 0x7fa3b129d44a  (/usr/lib/libc.so.6+0x8744a) (BuildId: 2f005a79cd1a8e385972f5a102f16adba414d75e)
    #7 0x7fa3b1320e3f  (/usr/lib/libc.so.6+0x10ae3f) (BuildId: 2f005a79cd1a8e385972f5a102f16adba414d75e)

Address 0x7fa3ad404040 is located in stack of thread T1 at offset 20544 in frame
    #0 0x5558a728b316 in parse_packet /home/kaian/Projects/sngrep/src/capture.c:321

  This frame has 3 object(s):
    [32, 36) 'size_capture' (line 337)
    [48, 52) 'size_payload' (line 339)
    [64, 20544) 'data' (line 333) <== Memory access at offset 20544 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
Thread T1 created by T0 here:
    #0 0x7fa3b144a4a7 in __interceptor_pthread_create /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_interceptors.cpp:208
    #1 0x5558a728f045 in capture_launch_thread /home/kaian/Projects/sngrep/src/capture.c:1027
    #2 0x5558a729bbdd in main /home/kaian/Projects/sngrep/src/main.c:451
    #3 0x7fa3b123984f  (/usr/lib/libc.so.6+0x2384f) (BuildId: 2f005a79cd1a8e385972f5a102f16adba414d75e)

SUMMARY: AddressSanitizer: stack-buffer-overflow /usr/src/debug/gcc/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:899 in __interceptor_memcpy
Shadow bytes around the buggy address:
  0x7fa3ad403d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fa3ad403e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fa3ad403e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fa3ad403f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fa3ad403f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7fa3ad404000: 00 00 00 00 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3
  0x7fa3ad404080: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3
  0x7fa3ad404100: f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
  0x7fa3ad404180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fa3ad404200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fa3ad404280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==10730==ABORTING

After 038a658

➜  # CC=gcc CXX=g++ CFLAGS="-g -fsanitize=address" CXXFLAGS="-g -fsanitize=address" ./configure
➜  # make
➜  # src/sngrep -N -R -I ~/Downloads/id0-stack-overflow                                        
Dialog count: 0

=================================================================
==11703==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 664 byte(s) in 1 object(s) allocated from:
    #0 0x7f2bcc4e0cd1 in __interceptor_calloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:77
    #1 0x7f2bccb205e8  (/usr/lib/libpcap.so.1+0x295e8) (BuildId: b1d10ed2f42804ba91995b233589e17e715d4218)

Direct leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x7f2bcc4e1369 in __interceptor_malloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x55916acdbac6 in vector_create /home/kaian/Projects/sngrep/src/vector.c:40
    #2 0x55916acc0244 in capture_offline /home/kaian/Projects/sngrep/src/capture.c:311
    #3 0x55916acd079c in main /home/kaian/Projects/sngrep/src/main.c:390
    #4 0x7f2bcc23984f  (/usr/lib/libc.so.6+0x2384f) (BuildId: 2f005a79cd1a8e385972f5a102f16adba414d75e)

Direct leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x7f2bcc4e1369 in __interceptor_malloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x55916acdbac6 in vector_create /home/kaian/Projects/sngrep/src/vector.c:40
    #2 0x55916acc0202 in capture_offline /home/kaian/Projects/sngrep/src/capture.c:310
    #3 0x55916acd079c in main /home/kaian/Projects/sngrep/src/main.c:390
    #4 0x7f2bcc23984f  (/usr/lib/libc.so.6+0x2384f) (BuildId: 2f005a79cd1a8e385972f5a102f16adba414d75e)

Direct leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x7f2bcc4e1369 in __interceptor_malloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x55916acdbac6 in vector_create /home/kaian/Projects/sngrep/src/vector.c:40
    #2 0x55916accfbb2 in main /home/kaian/Projects/sngrep/src/main.c:142
    #3 0x7f2bcc23984f  (/usr/lib/libc.so.6+0x2384f) (BuildId: 2f005a79cd1a8e385972f5a102f16adba414d75e)

Indirect leak of 96 byte(s) in 1 object(s) allocated from:
    #0 0x7f2bcc4e1369 in __interceptor_malloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x7f2bccb20868  (/usr/lib/libpcap.so.1+0x29868) (BuildId: b1d10ed2f42804ba91995b233589e17e715d4218)

SUMMARY: AddressSanitizer: 880 byte(s) leaked in 5 allocation(s).