search

mattconte / tlsf

Two-Level Segregated Fit memory allocator implementation.
1.16k stars 175 forks source link

security issue: prevent BadAlloc #22

Open savar opened 3 years ago

savar commented 3 years ago

see: https://msrc-blog.microsoft.com/2021/04/29/badalloc-memory-allocation-vulnerabilities-could-affect-wide-range-of-iot-and-ot-devices-in-industrial-medical-and-enterprise-networks/

in case tlsf_alloc is called with 0xffffffffu on a 32bit system the align_up() function will set the adjusted size to 0 and the tlfs_max() will set it to the minimum which was in my case 12 bytes. Therefore asking TLSF for SIZE_T_MAX (0xffffffff) will not fail with returning NULL but will return a pointer to a 12 byte memory block.

tlsf_alloc is kind of easy to fix, but the _realloc brother is less obvious. So fixing it in adjust_request_size() isn't really working.

savar commented 3 years ago

I just realized, adjust_request_size() can return already 0 in case the aligned value in adjust_request_size() is >= block_size_max and then this might kill tlsf_realloc() as it might call block_trim_used() with an adjust value of 0. Not sure if this is an issue but it looks very much like it.