Open xidoo123 opened 4 months ago
Hi @xidoo123,
thanks for reporting the issue. We'll have a look and provide a fix if necessary.
Regarding the assessment of the impact this issues does not impact the kernel. This is a utility function that can be used by an userland application by linking against the l4util
library.
Description
heap buffer overflow in base64_encode base64.c:262
Analyse
This function fails to consider edge cases.
A quick thought here is when
in_size=1
,temp
would be a heap chunk with 2 bytes long. However, later 5 bytes (will the null-terminate) are copied fromout
totemp
, causing heap buffer overflow in kernel.Impact
Depending on how the heap allocator is implemented, and the arch of victim machine this kernel runs on, this will cause DoS, data corruption and potentially privilege escape.
Fix
The fix here could be allocating at least 4 bytes memory.
Actually for base64 encoding, a good memory size might be like this.
Credits
Xdchase