buglwIP - A Lightweight TCP/IP stack - Bugs: bug #58554, Memory disclosure in the 6LoWPAN...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #58554: Memory disclosure in the 6LoWPAN implementation

Submitted by:  Wenqiang Li <silentdawn>
Submitted on:  Fri 12 Jun 2020 05:24:21 PM UTC  
 
Category:  Security-related Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  Erik Ekman <yarrick>
Open/Closed:  Closed Planned Release:  None
lwIP version:  git head

Fri 03 Jul 2020 04:57:57 PM UTC, comment #1: 
Erik Ekman <yarrick>
Project MemberIn charge of this item.
Fri 12 Jun 2020 05:24:21 PM UTC, original submission:  

Type:
Buffer overflow

Description:
This bug is similar to bug #58553. The function zepif_linkoutput() tries to parse an 6LoWPAN TX packet as UDP broadcast. When it calls the function pbuf_take_at() as shown in line 204 of zepif.c, the same incorrectly used parameters are passed as the Bug 2. In particular, the p->tot_len is the total length of the p->payload and all payloads length of its following pbuf. If p->tot_len is larger than the length of p->payload, the memory will leak to remote attackers through the network. To send the whole packet, it should use a loop to traverse the list of p->next and send all the payloads with length p->tot_len.

168
zepif_linkoutput(struct netif netif, struct pbuf p){

...
204
err = pbuf_take_at(q, p->payload, p->tot_len, sizeof(struct zep_hdr));

...
214
}

Result:
Memory disclosure.

Wenqiang Li <silentdawn>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by yarrick (Posted a comment)
  • -email is unavailable- added by silentdawn (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-07-03 yarrick StatusNone => Fixed
        Assigned toNone => yarrick
        Open/ClosedOpen => Closed

    Back to the top


    Powered by Savane 3.7