buglwIP - A Lightweight TCP/IP stack - Bugs: bug #58554, Memory disclosure in the 6LoWPAN...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #58554: Memory disclosure in the 6LoWPAN implementation

Submitter:  Wenqiang Li <silentdawn>
Submitted:  Fri 12 Jun 2020 05:24:21 PM UTC
   
 
Category:  Security-related Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  yarrick
Open/Closed:  Closed Planned Release:  None
lwIP version:  git head

Fri 03 Jul 2020 04:57:57 PM UTC, comment #1: 
Erik Ekman <yarrick>
Group Member
Fri 12 Jun 2020 05:24:21 PM UTC, original submission:  

Type:
Buffer overflow

Description:
This bug is similar to bug #58553. The function zepif_linkoutput() tries to parse an 6LoWPAN TX packet as UDP broadcast. When it calls the function pbuf_take_at() as shown in line 204 of zepif.c, the same incorrectly used parameters are passed as the Bug 2. In particular, the p->tot_len is the total length of the p->payload and all payloads length of its following pbuf. If p->tot_len is larger than the length of p->payload, the memory will leak to remote attackers through the network. To send the whole packet, it should use a loop to traverse the list of p->next and send all the payloads with length p->tot_len.

168
zepif_linkoutput(struct netif *netif, struct pbuf *p){

...
204
err = pbuf_take_at(q, p->payload, p->tot_len, sizeof(struct zep_hdr));

...
214
}

Result:
Memory disclosure.

Wenqiang Li <silentdawn>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by yarrick (Posted a comment)
  • -email is unavailable- added by silentdawn (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-07-03 yarrick StatusNone Fixed
        Assigned toNone yarrick
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code