buglwIP - A Lightweight TCP/IP stack - Bugs: bug #46128, Possible to trigger LWIP_ASSERT by...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46128: Possible to trigger LWIP_ASSERT by received SNMP messages

Submitted by:  Kerem Hadimli <keremhadimli>
Submitted on:  Mon 05 Oct 2015 09:31:19 AM UTC  
 
Category: Security-relatedSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: 1.4.1

Tue 06 Oct 2015 01:00:32 PM UTC, comment #3:

Ah, my bad, that 3rd ASSERT inside snmp_pdu_dec_varbindlist() was already removed in master -- I was checking on 1.4.1

thanks!

Kerem Hadimli <keremhadimli>
Tue 06 Oct 2015 12:43:23 PM UTC, comment #2:

I just checked the changes in 0737cfb8 , it fixes 2 of the 3 ASSERT cases, but not the 1st one (inside snmp_pdu_dec_varbindlist(): LWIP_ASSERT("invalid length", len <= 0xff) ).

It is still possible to send a SNMPSET with a string value of >255, as the fixed function is called after this ASSERT.

Kerem Hadimli <keremhadimli>
Tue 06 Oct 2015 10:42:45 AM UTC, comment #1:

Fied, thanks for the patch.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Mon 05 Oct 2015 09:31:19 AM UTC, original submission:

I noticed the following behavior on 1.4.1, but also I see that the code is same in git master.

When an SNMP request is received, snmp_recv() is called. snmp_recv() calls snmp_pdu_dec_varbindlist() for incoming SNMP variables.

For strings, snmp_pdu_dec_varbindlist() might assert itself:

1. LWIP_ASSERT("invalid length", len <= 0xff);

afterwards it calls snmp_varbind_alloc().

snmp_varbind_alloc() checks for:

2. If OID size is larger than the configured max OID size:
LWIP_ASSERT("SNMP_MAX_TREE_DEPTH is configured too low", i <= SNMP_MAX_TREE_DEPTH);

3. If variable size (string len) is larger than the configured max variable size:

LWIP_ASSERT("SNMP_MAX_OCTET_STRING_LEN is configured too low", vb->value_len <= SNMP_MAX_VALUE_SIZE);

Probably the idea is, if these functions are used for outgoing messages, developer should know about the wrong configuration. But it is possible to use either of these 3 assert locations to cause an assert on a LwIP device remotely.

Kerem Hadimli <keremhadimli>

 

Attached Files
file #35073:  msg_in.patch added by keremhadimli (3KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by keremhadimli (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 06 Oct 2015 10:42:45 AM UTCgoldsimonStatusNone=>Fixed
      Assigned toNone=>goldsimon
      Open/ClosedOpen=>Closed
    Mon 05 Oct 2015 10:18:39 AM UTCkeremhadimliAttached File-=>Added msg_in.patch, #35073

    Back to the top


    Powered by Savane 3.1-cleanup1