Penetration Test Report (X41 D-Sec): X41 OSTIF libcap Code Review 2023 Final Report

SourceCodeAuditonlibcap
forOpenSourceTechnologyImprovementFund(OSTIF)
FinalReportandManagementSummary
2023-05-10
X41 D-SEC GmbH
Krefelder Str. 123
D-52070 Aachen
Amtsgericht Aachen: HRB19989
https://x41-dsec.de/
info@x41-dsec.de
OrganizedbytheOpenSourceTechnologyImprovementFund
SourceCodeAuditonlibcap forOpenSourceTechnologyImprovementFund(OSTIF)
Revision Date Change Author(s)
1 2023-04-14 FinalReportDraft MSc. H.Moesl,Dipl.-Ing. D.Gstir,R.
Weinberger,andM.Vervier
2 2023-05-10 ReportMarkedForPub- M.Vervier
lication
X41D-SecGmbH PUBLIC Page1of28
SourceCodeAuditonlibcap forOpenSourceTechnologyImprovementFund(OSTIF)
Contents
1 ExecutiveSummary 4
1.1 FindingsOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2 Introduction 7
2.1 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.2 Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.3 RecommendedFurtherTests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3 RatingMethodologyforSecurityVulnerabilities 11
3.1 CommonWeaknessEnumeration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
4 Results 13
4.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
4.2 InformationalNotes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
5 AboutX41D-SecGmbH 21
A FuzzingHarnesses 23
A.1 CLIFuzzingofToolscapsh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
A.2 CLIFuzzingofToolsgetcap,setcap,getpcaps . . . . . . . . . . . . . . . . . . . . . . 24
A.3 FuzzingHarnessforcap_copy_int,cap_from_text,cap_to_text,cap_from_name . . 24
A.4 OtherTestHarnesses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
X41D-SecGmbH PUBLIC Page2of28
SourceCodeAuditonlibcap forOpenSourceTechnologyImprovementFund(OSTIF)
Dashboard
Target
Customer OpenSourceTechnologyImprovementFund(OSTIF)
Name libcap
Type SourceCode
Version commit(5496a0e3854dba9374823e9b561ee8c5fd9c59f4)
Engagement
Type SourceCodeAudit
Consultants 3:MSc.H.Moesl,Dipl.-Ing.D.Gstir,andR.Weinberger
EngagementEffort 15person-days,2023-03-17to2023-04-12
Totalissuesfound 2
Critical - 0
High - 0
Medium - 1 CWE-190(1) CWE-401(1)
Low - 1
None - 3
0 0.2 0.4 0.6 0.8 1 1.2 1.4 1.6 1.8 2 2.2 2.4 2.6 2.8 3
Figure1:IssueOverview(l:Severity,r:CWEDistribution)
X41D-SecGmbH PUBLIC Page3of28
SourceCodeAuditonlibcap forOpenSourceTechnologyImprovementFund(OSTIF)
1 Executive Summary
In March and April 2023, X41 D-Sec GmbH performed a source code audit against libcap to
identify security vulnerabilities. The test was made possible by the Open Source Technology
ImprovementFund1.
AtotaloftwovulnerabilitieswerediscoveredduringtheauditbyX41.Nonewereratedashaving
a critical or high severity, one as medium, and one as low. Additionally, three issues without a
directsecurityimpactwereidentified.
Low - 1 Medium - 1
Figure1.1:IssuesandSeverity
libcapisalibraryforgettingandsettingPOSIX.1e(formerlyPOSIX6)draft15capabilities,with
nativelysupportedlanguagesofC/C++andGo. Asitiscommonforcompiledlanguages,apar-
ticularfocushasbeenplacedontheidentificationoftypicalmemorysafetyissuessuchasbuffer
overflows,memorydisclosure,oruse-after-free.Furthermore,thetestingteamputfocusandef-
fortintotheidentificationoflogicvulnerabilitiessuchasdisagreementbetweenkernelandlibcap
1https://ostif.org
X41D-SecGmbH PUBLIC Page4of28
SourceCodeAuditonlibcap forOpenSourceTechnologyImprovementFund(OSTIF)
shadowstate.
Inasourcecodeaudit,thetestersreceiveallavailableinformationaboutthetarget.Thetestwas
performedbythreeexperiencedsecurityexpertsbetween2023-03-17and2023-04-12.
Despitemultipleauditorsindependentlyreviewingthesamesectionofthecodeforbettercover-
age,onlytwovulnerabilitieshavebeenidentifiedduringthereviewprocess. Therefore,address-
ing these vulnerabilities can add an additional layer of defense and help reduce the potential
attacksurfaceofthelibrary.
To further improve the security posture, it is encouraged to implement additional security con-
trols, which have been listed as part of the Informational Notes list. These describe potential
improvementswithregardstocodesafetywhichmakeexploitingpotentialbugsharder.
It is worth emphasizing that the libcap library was put through rigorous testing by X41’s team
and, overall, itwasfoundtobehighlyrobustandsecure. Thetestingprocessrevealedthatthe
libcapisdesignedandimplementedwithgreatcareandattentiontodetail,anditdemonstrated
a strong ability to withstand scrutiny. As a result, the overall impression and outcome of this
securityassessmentisverypositive.
Again,itmustbereiteratedthatthisassessmentprovidedvaluableinsightsintothesecuritypos-
tureatthetimeoftesting,butitisimportanttonotethatanypenetrationtestisunabletoguar-
anteethatthesoftwarecomplexisfreeofadditionalbugs.
In terms of dynamic testing, the testing team developed several fuzz testing harnesses. Fuzz
testingis, ingeneral, essentialfortheoverallsecurityofthelibcapproject, especiallysinceitis
implementedinC,whichisoftenpronetomemorycorruptionvulnerabilities.Forthepurposeof
thistest,codecoveragedrivenfuzzingusingAFL++incombinationwithaddressspacesanitizers
(suchasASAN)hasbeenperformed.Eventhoughnonewissueswereidentifiedusingthedevel-
opedharnesses,itishighlyrecommendedtoincorporatethedevelopedharnessesintothelibcap
projectandtomakefuzzingafixedpartofthelibcap,eitherusingAFL++orlibFuzzer,resulting
inbettertestingcoverage.
X41D-SecGmbH PUBLIC Page5of28
SourceCodeAuditonlibcap forOpenSourceTechnologyImprovementFund(OSTIF)
1.1 Findings Overview
DESCRIPTION SEVERITY ID REF
MemoryLeakon LOW LCAP-CR-23-01 4.1.1
funcpthread_create()Error
IntegerOverflowin MEDIUM LCAP-CR-23-02 4.1.2
func_libcap_strdup()
MissingCheckof NONE LCAP-CR-23-100 4.2.1
funcpam_set_data()ReturnCode
MissingPermissionCheckofUserCapabilityFile NONE LCAP-CR-23-101 4.2.2
ProblematicUsageofextttpthread_kill() NONE LCAP-CR-23-102 4.2.3
Table1.1:Security-RelevantFindings
X41D-SecGmbH PUBLIC Page6of28
SourceCodeAuditonlibcap forOpenSourceTechnologyImprovementFund(OSTIF)
2 Introduction
Theassessmentcomprisedasecurityreviewofthelibcaplibrary,utilizingstaticsourcecodeanal-
ysisaswellasdynamictestingusingdedicatedfuzztestingharnesses.Thebranchinscopeforthis
inspectionwasthemainbranchwiththecommitid5496a0e3854dba9374823e9b561ee8c5fd9c59f4.
Atthebeginningoftheproject,aninitialkick-offmeetingwassetupbetweenX41,OSTIFandthe
maintainerofthelibraryinordertotoalignonthescopeofthisengagement.Themeetinghelped
toclarifytheexpectationsofthisassessmentandalsonarroweddownthekeyfocusareas.
Since the testing team had a clear understanding of the scope and goals, X41 did not need to
interact extensively with OSTIF or the maintainer. However, the communication was excellent,
andhelpwasprovidedwheneverrequested.Generallyspeaking,OSTIFaswellasthemaintainer
ofthelibrarydeservealotofpraisefortheiroverallsupportandassistance.Itwasapleasurefor
thetestingteamworkingwiththem.
Fromaprogrammingstyleandsoftwaredesignperspectivethecodeanddesigniscleanandvery
wellwritten,withsecurityinmind.
2.1 Scope
During the kickoff call, the audit team, in collaboration with OSTIF and the maintainer, defined
and narrowed down the scope of the testing efforts. It was mutually agreed that the primary
focusforlibcapwouldbeonconductingin-depthstaticcodeanalysisandincorporatingfuzzing
supportforvariousfunctionsofinterest.
Inadditiontothat,theassessmentfocusedageneralexaminationfortypicalmemorycorruption
vulnerabilities.
X41D-SecGmbH PUBLIC Page7of28
SourceCodeAuditonlibcap forOpenSourceTechnologyImprovementFund(OSTIF)
2.2 Coverage
Asecurityassessmentattemptstofindthemostimportantorsometimesasmanyoftheexisting
problemsaspossible,thoughitispracticallyneverpossibletoruleoutthepossibilityofadditional
weaknessesbeingfoundinthefuture.
AmanualapproachforcodereviewisusedbyX41.Thisprocesswascombinedwithfuzzinggiven
thenatureoflibcapbeingexposedtoparsingofpotentiallyuntrus