buglwIP - A Lightweight TCP/IP stack - Bugs: bug #66058, Assertion "sys_timeout:...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #66058: Assertion "sys_timeout: timeout != NULL

Submitter:  Mohammad <md7>
Submitted:  Sat 03 Aug 2024 12:42:13 PM UTC
   
 
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  2.2.0

Sat 11 Jan 2025 07:56:08 AM UTC, comment #3: 

comment #2:

> There is an error in the calculation of the amount of timers needed, LWIP_NUM_SYS_TIMEOUT_INTERNAL. It fails to include a timer for DHCPv6 if it is requested. It is used as a default value for MEMP_NUM_SYS_TIMEOUT so if it is not overridden the amount of timers needed is too low and the assert will occur.
> Please see if error still occurs with attached patch. In any case the patch should be pushed.
>
> (file #56673)



Thank you for the update. I downloaded the latest version and tested it with the data generated by AFL. The issue is resolved with the patch applied, and no crashes were observed.

Could this issue potentially qualify for a CVE?

Mohammad <md7>
Wed 04 Dec 2024 06:33:41 PM UTC, comment #2: 

There is an error in the calculation of the amount of timers needed, LWIP_NUM_SYS_TIMEOUT_INTERNAL. It fails to include a timer for DHCPv6 if it is requested. It is used as a default value for MEMP_NUM_SYS_TIMEOUT so if it is not overridden the amount of timers needed is too low and the assert will occur.
Please see if error still occurs with attached patch. In any case the patch should be pushed.

(file #56673)

Eric Koldeweij <eric_koldeweij>
Sat 03 Aug 2024 12:46:15 PM UTC, comment #1: 


original submission:

> A flaw was discovered in the LWIP during a fuzz testing session(by AFL). THe issue is characterized by repeated crashes that consistently trigger an assertion failure, specifically in the sys_timeout() function.
>
> All crash files generated during the fuzz testing session have been attached to this report for further analysis.


./lwip_fuzz

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=0x6, no_tid=no_tid@entry=0x0)
    at ./nptl/pthread_kill.c:44
#1  0x00007ffff7d42b7f in __pthread_kill_internal (signo=0x6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#2  0x00007ffff7cf44e2 in __GI_raise (sig=sig@entry=0x6) at ../sysdeps/posix/raise.c:26
#3  0x00007ffff7cdd4ed in __GI_abort () at ./stdlib/abort.c:79
#4  0x00000000007f265b in sys_timeout_abs (abs_time=0x167a4dc, handler=0x7f1960 <tcpip_tcp_timer>, arg=0x0)
    at ../../contrib/../src//core/timeouts.c:190
#5  0x00000000007f194c in sys_timeout (msecs=0xfa, handler=0x7f1960 <tcpip_tcp_timer>, arg=0x0)
    at ../../contrib/../src//core/timeouts.c:304
#6  0x00000000007f180b in tcp_timer_needed () at ../../contrib/../src//core/timeouts.c:174
#7  0x000000000077a600 in tcp_listen_input (pcb=0x1479f30 <memp_memory_TCP_PCB_LISTEN_base+528>)
    at ../../contrib/../src//core/tcp_in.c:701
#8  0x000000000076bd4e in tcp_input (p=0x14b769a <memp_memory_PBUF_POOL_base+244986>, inp=0x7fffffffdb20)
    at ../../contrib/../src//core/tcp_in.c:380
#9  0x00000000008e4e2c in ip4_input (p=0x14b769a <memp_memory_PBUF_POOL_base+244986>, inp=0x7fffffffdb20)
    at ../../contrib/../src//core/ipv4/ip4.c:709
#10 0x0000000000a3d75c in ethernet_input (p=0x14b769a <memp_memory_PBUF_POOL_base+244986>, netif=0x7fffffffdb20)
    at ../../contrib/../src//netif/ethernet.c:186
#11 0x00000000004d42cb in input_pkt (netif=0x7fffffffdb20, data=0x1472728 <pktbuf+72> "", len=0x48) at fuzz.c:107
#12 0x00000000004d379a in input_pkts (netif=0x7fffffffdb20, data=0x14726e0 <pktbuf> "", len=0x48) at fuzz.c:137
#13 0x00000000004d128d in main (argc=0x1, argv=0x7fffffffdf08) at fuzz.c:186

Mohammad <md7>
Sat 03 Aug 2024 12:42:13 PM UTC, original submission:  

A flaw was discovered in the LWIP during a fuzz testing session(by AFL). THe issue is characterized by repeated crashes that consistently trigger an assertion failure, specifically in the sys_timeout() function.

All crash files generated during the fuzz testing session have been attached to this report for further analysis.

Mohammad <md7>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #56673:  lwiptimer.patch added by eric_koldeweij (814B - text/x-patch)
file #56334:  crashes.tar added by md7 (20KiB - application/x-tar)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by eric_koldeweij (Updated the item)
  • -email is unavailable- added by md7 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-12-04 eric_koldeweij Attached File- Added lwiptimer.patch, #56673
    2024-08-03 md7 Attached File- Added crashes.tar, #56334

    Back to the top

    Powered by Savane 3.15-e6e5.
    Corresponding source code