buglwIP - A Lightweight TCP/IP stack - Bugs: bug #53747, Bug in NetBIOS NS


You are not allowed to post comments on this tracker with your current authentication level.

bug #53747: Bug in NetBIOS NS

Submitted by:  Arkadiusz Wróbel <catsuryuu>
Submitted on:  Wed 25 Apr 2018 06:23:02 AM UTC  
Category:  Security-related Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  Simon Goldschmidt <goldsimon>
Open/Closed:  Closed Planned Release:  2.1.0
lwIP version:  git head

Wed 25 Apr 2018 06:57:16 PM UTC, comment #1: 

Fix pushed in b2ef9d90, thanks for reporting.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Wed 25 Apr 2018 06:23:02 AM UTC, original submission:  

The packet's size should be verified before casting to 'struct netbios_hdr *'.
Similarly with 'struct netbios_name_hdr *'.

I think p->tot_len should be at least 50 to work properly.

If an external host send a query with length equal to 48, two uninitialized bytes from heap will be send back to it (in 'cls' field).
I attached an example of the data leak in 'example_leak.pcapng' (0x4242 leaked from the previous packet).
I worked on 'echop' with 'echop_run_NBNS.patch'. The patch is only to trigger the bug.

[Related with: lwip/src/apps/netbiosns/netbiosns.c:343-344]

Arkadiusz Wróbel <catsuryuu>


Attached Files
file #44018:  echop_run_NBNS.patch added by catsuryuu (579B - text/x-patch - The patch is only to trigger the bug.)
file #44019:  example_leak.pcapng added by catsuryuu (680B - application/x-pcapng - The patch is only to trigger the bug.)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by catsuryuu (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-04-25 goldsimon Planned ReleaseNone => 2.1.0
    2018-04-25 goldsimon StatusNone => Fixed
        Assigned toNone => goldsimon
        Open/ClosedOpen => Closed
    2018-04-25 catsuryuu Attached File- => Added echop_run_NBNS.patch, #44018
        Attached File- => Added example_leak.pcapng, #44019

    Back to the top

    Powered by Savane 3.5