helpThe oSIP library - Support: sr #109132, Heap buffer overflow in...

 
 

sr #109132: Heap buffer overflow in *osip_body_to_str* in libosip2-4.1.0

Submitted by:  Bhargava Shastry <bshastry>
Submitted on:  Fri 02 Sep 2016 08:42:34 PM UTC  
 
Category:  None Priority:  5 - Normal
Severity:  6 - Security Status:  Done
Privacy:  Public Assigned to:  Aymeric MOIZARD <aymeric>
Open/Closed:  Closed Operating System:  None

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 03 Sep 2016 02:06:54 PM UTC, comment #1: 

fix in git commit b9dd097

patch hasn't been applied completely. I have only applied the patch that fix the missing 2 bytes allocation.

To be consistent with other code, I have used 3 instead of 2 and used < instead of <=.

To improve the behavior, body->length is also added to avoid a future reallocation from happening.

Please re-open if any issue with the change applied!

Aymeric MOIZARD <aymeric>
Project AdministratorIn charge of this item.
Fri 02 Sep 2016 08:42:34 PM UTC, original submission:  

Hi, While fuzzing the torture_test application, I discovered the following bug using afl-fuzz and the patch using an in-house crash triage tool called Orthrus.

Steps to reproduce

$ ./configure --enable-test --disable-shared
$ make -j
$ ./src/test/torture_test <ATTACHED_INPUT> 0 -c

Attached input filename starts with ASAN

Bug

In function osip_body_to_str, the initially computed length for storing stringified SIP body length is incorrect because it does not anticipate the addition of the CRLF characters when body->body->content_type is not NULL:

// Incorrect computation
length = 15 + body->length + (osip_list_size (body->headers) * 40);
tmp_body = (char *) osip_malloc (length);

...
  if ((osip_list_size (body->headers) > 0) || (body->content_type != NULL)) {
// tmp_body may overflow here
    tmp_body = osip_strn_append (tmp_body, CRLF, 2);
  }

where tmp_body holds the stringified SIP body. On detecting the corrupted heap metadata around the overflowed buffer, glibc aborts.

Fix

The attached patch (filename 0001...) fixes this bug by sanitizing (i.e., checking bounds and realloc if necessary) the problematic string append operation.

Security considerations

The bug can definitely lead to a denial of service for a VoIP application using the affected libosip version (4.1.0). Note that the OpenWrt distribution sources this version of libosip2. Exploitation is not certain but cannot be ruled out. A CVE is advisable.

Reporter

  • Bhargava Shastry, SecT, TU Berlin
Bhargava Shastry <bshastry>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #38413:  0001-Patch-2.1-Fixes-heap-buffer-overflow-in-osip_body_to_s.patch added by bshastry (887B - text/x-patch - Crashing input and suggested patch)
file #38414:  ASAN:2842033635,SESSION002:id:000087,sig:06,src:001223,op:havoc,rep:2 added by bshastry (668B - application/octet-stream - Crashing input and suggested patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by aymeric (Updated the item)
  • -email is unavailable- added by bshastry (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-09-03 aymeric StatusIn Progress => Done
        Open/ClosedOpen => Closed
    2016-09-03 aymeric StatusNone => In Progress
        Assigned toNone => aymeric
        Operating SystemGNU/Linux => None
    2016-09-02 bshastry Attached File- => Added 0001-Patch-2.1-Fixes-heap-buffer-overflow-in-osip_body_to_s.patch, #38413
        Attached File- => Added ASAN:2842033635,SESSION002:id:000087,sig:06,src:001223,op:havoc,rep:2, #38414

    Back to the top


    Powered by Savane 3.5