buglwIP - A Lightweight TCP/IP stack - Bugs: bug #61479, MQTT: DoS caused by unsigned...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #61479: MQTT: DoS caused by unsigned integer overflow

Submitted by:  Hyeonsu Kim <icekrim>
Submitted on:  Sun 14 Nov 2021 06:31:19 AM UTC
 
Category:  Security-related Severity:  3 - Normal
Item Group:  Crash Error Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  * git head
* Mandatory Fields

Add a New Comment (Rich Markup)
   

Comment Type & Canned Response:
       No canned response available

 

Sun 14 Nov 2021 06:31:19 AM UTC, original submission:  

Summary:
Integer overflow in mqtt_parse_incoming of src/apps/mqtt/mqtt.c allows attackers to perform a Denial of Service via MQTT packet with fixed header length of 256 bytes or more

Description:

mqtt.c 866

while (p->tot_len > in_offset) {
if ((fixed_hdr_len < 2) || ((b & 0x80) != 0)) {
  if (fixed_hdr_len < client->msg_idx) {
    b = client->rx_buffer[fixed_hdr_len];
  } else {
    b = pbuf_get_at(p, in_offset++);
    client->rx_buffer[client->msg_idx++] = b;
  }
  fixed_hdr_len++;
  if (fixed_hdr_len >= 2) {
    msg_rem_len |= (u32_t)(b & 0x7f) << ((fixed_hdr_len - 2) * 7);
    if ((b & 0x80) == 0) {

....

If it receives a packet of 256 bytes with b & 80 == 1, it goes into an infinite loop and the device stops. (like [0x80]*256)

This is because fixed_hdr_len, which is a u8 type, can never be larger than client->msg_idx (in this case 256), so in_offset cannot be increased.

I have completed the POC on the stm32 board I have personally, and I will prepare linux porting if necessary. Thank you.

Hyeonsu Kim <icekrim>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by icekrim (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

     

     

     

    No changes have been made to this item

    Back to the top


    Powered by Savane 3.9