buglwIP - A Lightweight TCP/IP stack - Bugs: bug #46128, Possible to trigger LWIP_ASSERT by...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46128: Possible to trigger LWIP_ASSERT by received SNMP messages

Submitter:  Kerem Hadimli <keremhadimli>
Submitted:  Mon 05 Oct 2015 09:31:19 AM UTC
   
 
Category:  Security-related Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  1.4.1

Tue 06 Oct 2015 01:00:32 PM UTC, comment #3: 

Ah, my bad, that 3rd ASSERT inside snmp_pdu_dec_varbindlist() was already removed in master -- I was checking on 1.4.1

thanks!

Kerem Hadimli <keremhadimli>
Tue 06 Oct 2015 12:43:23 PM UTC, comment #2: 

I just checked the changes in 0737cfb8 , it fixes 2 of the 3 ASSERT cases, but not the 1st one (inside snmp_pdu_dec_varbindlist(): LWIP_ASSERT("invalid length", len <= 0xff) ).

It is still possible to send a SNMPSET with a string value of >255, as the fixed function is called after this ASSERT.

Kerem Hadimli <keremhadimli>
Tue 06 Oct 2015 10:42:45 AM UTC, comment #1: 

Fied, thanks for the patch.

Simon Goldschmidt <goldsimon>
Group administrator
Mon 05 Oct 2015 09:31:19 AM UTC, original submission:  

I noticed the following behavior on 1.4.1, but also I see that the code is same in git master.


When an SNMP request is received, snmp_recv() is called. snmp_recv() calls snmp_pdu_dec_varbindlist() for incoming SNMP variables.

For strings, snmp_pdu_dec_varbindlist() might assert itself:

1. LWIP_ASSERT("invalid length", len <= 0xff);

afterwards it calls snmp_varbind_alloc().


snmp_varbind_alloc() checks for:

2. If OID size is larger than the configured max OID size:
LWIP_ASSERT("SNMP_MAX_TREE_DEPTH is configured too low", i <= SNMP_MAX_TREE_DEPTH);

3. If variable size (string len) is larger than the configured max variable size:

LWIP_ASSERT("SNMP_MAX_OCTET_STRING_LEN is configured too low", vb->value_len <= SNMP_MAX_VALUE_SIZE);


Probably the idea is, if these functions are used for outgoing messages, developer should know about the wrong configuration. But it is possible to use either of these 3 assert locations to cause an assert on a LwIP device remotely.

Kerem Hadimli <keremhadimli>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #35073:  msg_in.patch added by keremhadimli (3KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by keremhadimli (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-10-06 goldsimon StatusNone Fixed
        Assigned toNone goldsimon
        Open/ClosedOpen Closed
    2015-10-05 keremhadimli Attached File- Added msg_in.patch, #35073

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code