mzillgith
commented
3 weeks ago Thank you for reporting the issue.
I think this is the same as #509 and not a separate issue. With the fix for #509 this is no longer triggered.
Open gnbon opened 3 weeks ago
mzillgith
commented
3 weeks ago Thank you for reporting the issue.
I think this is the same as #509 and not a separate issue. With the fix for #509 this is no longer triggered.
Summary:
An Out-of-Bound Read vulnerability was discovered in the
BerDecoder_decodeBooleanfunction of theber_decode.cfile in the libiec61850 library through fuzzing. This vulnerability is triggered when parsing the0x87tag in theparseGoosePayloadfunction ofgoose_receiver.c.Detailed Description:
The vulnerability occurs in the
parseGoosePayloadfunction when processing the0x87tag. TheBerDecoder_decodeBooleanfunction is called to decode thesimulationvalue. However, thebufPosindex used to read from the input buffer is not properly validated, leading to an out-of-bounds read.The
BerDecoder_decodeBooleanfunction reads a value from the buffer using thebufPosindex. IfbufPosis outside the valid range of the buffer, the function ends up accessing memory beyond the buffer's boundaries.The AddressSanitizer (ASan) log confirms the presence of the vulnerability. It shows that a read operation of size 1 byte occurred at address
0x7f7a6fcff828, which corresponds to a previously freed (poisoned) memory region. This indicates that theBerDecoder_decodeBooleanfunction is accessing an invalid memory area.The stack trace reveals that the issue originates from line 218 of the
BerDecoder_decodeBooleanfunction, which is called fromparseGoosePayloadat line 796. TheparseGoosePayloadfunction, in turn, is called fromparseGooseMessageat line 1002.Root Cause:
The root cause of the vulnerability lies in the lack of proper validation of the
bufPosvalue in theBerDecoder_decodeBooleanfunction. The function does not ensure thatbufPosfalls within the valid range of the input buffer, allowing out-of-bounds reads to occur.When the
parseGoosePayloadfunction processes the0x87tag and callsBerDecoder_decodeBoolean, it passes thebufPosvalue without validating its range. If thebufPosis pointing to a location beyond the valid buffer size, it leads to accessing memory that is outside the allocated buffer, resulting in an out-of-bounds read.The vulnerability arises due to insufficient input validation and improper handling of the
bufPosvalue in theBerDecoder_decodeBooleanfunction. The lack of proper boundary checks allows the function to read from invalid memory locations, potentially leading to program crashes, information disclosure, or other unintended behavior.Impact:
An attacker can use this vulnerability to leak data by sending deliberately crafted input data to trigger abnormal behavior in the program. This can potentially lead to information disclosure or other unintended consequences.
Recommendation:
To mitigate this vulnerability, it is crucial to perform thorough boundary checks regardless of the size of the input data. The code should be modified to ensure that bufPos never exceeds the valid range of the buffer. Additionally, proper input validation and error handling should be implemented to gracefully handle cases where the input data size is unexpected or malformed.
Proof of Concept (PoC):
A proof-of-concept exploit has been provided in the attached file. This PoC demonstrates how the vulnerability can be triggered by sending specially crafted input data to the affected functions. poc.zip
AddressSanitizer
The AddressSanitizer (ASan) log shows:
CVE Assignment Request:
I kindly request the assignment of a Common Vulnerabilities and Exposures (CVE) identifier for the Out-of-Bound Read vulnerability.