Exploit-DB #45950
Description: Wireshark - 'cdma2k_message_ACTIVE_SET_RECORD_FIELDS' Stack Corruption
Type: dos
Platform: multiple
Date: 2018-12-04
Author: Google Security Research

Exploit:
The following crash due to a stack-based out-of-bounds memory access can be observed in an ASAN build of Wireshark (current git master), by feeding a malformed file to tshark ("$ ./tshark -nVxr /path/to/file"):

Attached are three files which trigger the crash.

--- cut ---
==25039==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc0298b086 at pc 0x7fb8215577d8 bp 0x7ffc0298b050 sp 0x7ffc0298b048
READ of size 2 at 0x7ffc0298b086 thread T0
    #0 0x7fb8215577d7 in cdma2k_message_ACTIVE_SET_RECORD_FIELDS wireshark/epan/dissectors/packet-cdma2k.c:3861:89
    #1 0x7fb8215577d7 in cdma2k_message_HANDOFF_DIR wireshark/epan/dissectors/packet-cdma2k.c:3116
    #2 0x7fb821546ea5 in cdma2k_message_decode wireshark/epan/dissectors/packet-cdma2k.c:1224:19
    #3 0x7fb821544f23 in dissect_cdma2k wireshark/epan/dissectors/packet-cdma2k.c:4406:13
    #4 0x7fb823376be0 in call_dissector_through_handle wireshark/epan/packet.c:706:9
    #5 0x7fb823376be0 in call_dissector_work wireshark/epan/packet.c:791
    #6 0x7fb823372cb8 in call_dissector_only wireshark/epan/packet.c:3141:8
    #7 0x7fb823372cb8 in call_dissector_with_data wireshark/epan/packet.c:3154
    #8 0x7fb821908908 in gcsna_message_GCSNA1xCircuitService wireshark/epan/dissectors/packet-gcsna.c:211:9
    #9 0x7fb821908908 in gcsna_message_decode wireshark/epan/dissectors/packet-gcsna.c:119
    #10 0x7fb821908908 in dissect_gcsna wireshark/epan/dissectors/packet-gcsna.c:342
    #11 0x7fb823376be0 in call_dissector_through_handle wireshark/epan/packet.c:706:9
    #12 0x7fb823376be0 in call_dissector_work wireshark/epan/packet.c:791
    #13 0x7fb823372cb8 in call_dissector_only wireshark/epan/packet.c:3141:8
    #14 0x7fb823372cb8 in call_dissector_with_data wireshark/epan/packet.c:3154
    #15 0x7fb82307a3d3 in dissect_s1ap_Cdma2000PDU wireshark/./asn1/s1ap/s1ap.cnf:638:9
    #16 0x7fb82307a3d3 in dissect_Cdma2000PDU_PDU wireshark/./asn1/s1ap/s1ap.cnf:1313
    #17 0x7fb823376be0 in call_dissector_through_handle wireshark/epan/packet.c:706:9
    #18 0x7fb823376be0 in call_dissector_work wireshark/epan/packet.c:791
    #19 0x7fb823376610 in dissector_try_uint_new wireshark/epan/packet.c:1383:8
    #20 0x7fb82309bd90 in dissect_ProtocolIEFieldValue wireshark/./asn1/s1ap/packet-s1ap-template.c:367:11
    #21 0x7fb8220c7430 in dissect_per_open_type_internal wireshark/epan/dissectors/packet-per.c:232:5
    #22 0x7fb8220c7692 in dissect_per_open_type_pdu_new wireshark/epan/dissectors/packet-per.c:253:9
    #23 0x7fb8220d5ff9 in dissect_per_sequence wireshark/epan/dissectors/packet-per.c:1899:12
    #24 0x7fb82309b878 in dissect_s1ap_ProtocolIE_Field wireshark/./asn1/s1ap/s1ap.cnf:145:12
    #25 0x7fb8220cec9e in dissect_per_sequence_of_helper wireshark/epan/dissectors/packet-per.c:564:10
    #26 0x7fb8220cec9e in dissect_per_constrained_sequence_of wireshark/epan/dissectors/packet-per.c:939
    #27 0x7fb8230a8950 in dissect_s1ap_ProtocolIE_Container wireshark/./asn1/s1ap/s1ap.cnf:158:12
    #28 0x7fb8220d5ff9 in dissect_per_sequence wireshark/epan/dissectors/packet-per.c:1899:12
    #29 0x7fb82308f5ee in dissect_s1ap_E_RABSetupRequest wireshark/./asn1/s1ap/s1ap.cnf:2014:12
    #30 0x7fb82308f5ee in dissect_E_RABSetupRequest_PDU wireshark/./asn1/s1ap/s1ap.cnf:2945
    #31 0x7fb823376be0 in call_dissector_through_handle wireshark/epan/packet.c:706:9
    #32 0x7fb823376be0 in call_dissector_work wireshark/epan/packet.c:791
    #33 0x7fb823376610 in dissector_try_uint_new wireshark/epan/packet.c:1383:8
    #34 0x7fb8230a9442 in dissect_InitiatingMessageValue wireshark/./asn1/s1ap/packet-s1ap-template.c:402:11
    #35 0x7fb8220c7430 in dissect_per_open_type_internal wireshark/epan/dissectors/packet-per.c:232:5
    #36 0x7fb8220c7692 in dissect_per_open_type_pdu_new wireshark/epan/dissectors/packet-per.c:253:9
    #37 0x7fb8220d5ff9 in dissect_per_sequence wireshark/epan/dissectors/packet-per.c:1899:12
    #38 0x7fb8230a9098 in dissect_s1ap_InitiatingMessage wireshark/./asn1/s1ap/s1ap.cnf:145:12
    #39 0x7fb8220d4d35 in dissect_per_choice wireshark/epan/dissectors/packet-per.c:1749:4
    #40 0x7fb8230993a4 in dissect_s1ap_S1AP_PDU wireshark/./asn1/s1ap/s1ap.cnf:179:12
    #41 0x7fb8230993a4 in dissect_S1AP_PDU_PDU wireshark/./asn1/s1ap/s1ap.cnf:3841
    #42 0x7fb8230993a4 in dissect_s1ap wireshark/./asn1/s1ap/packet-s1ap-template.c:451
    #43 0x7fb823376be0 in call_dissector_through_handle wireshark/epan/packet.c:706:9
    #44 0x7fb823376be0 in call_dissector_work wireshark/epan/packet.c:791
    #45 0x7fb823376610 in dissector_try_uint_new wireshark/epan/packet.c:1383:8
    #46 0x7fb82230cd76 in dissect_payload wireshark/epan/dissectors/packet-sctp.c:2531:9
    #47 0x7fb822306b25 in dissect_data_chunk wireshark/epan/dissectors/packet-sctp.c:3494:16
    #48 0x7fb822302464 in dissect_sctp_chunk wireshark/epan/dissectors/packet-sctp.c
    #49 0x7fb8222fffd9 in dissect_sctp_chunks wireshark/epan/dissectors/packet-sctp.c:4610:9
    #50 0x7fb8222fffd9 in dissect_sctp_packet wireshark/epan/dissectors/packet-sctp.c:4751
    #51 0x7fb8222fc59b in dissect_sctp wireshark/epan/dissectors/packet-sctp.c:4815:3
    #52 0x7fb823376be0 in call_dissector_through_handle wireshark/epan/packet.c:706:9
    #53 0x7fb823376be0 in call_dissector_work wireshark/epan/packet.c:791
    #54 0x7fb823376610 in dissector_try_uint_new wireshark/epan/packet.c:1383:8
    #55 0x7fb821b8ee45 in ip_try_dissect wireshark/epan/dissectors/packet-ip.c:1831:7
    #56 0x7fb821bd37d9 in ipv6_dissect_next wireshark/epan/dissectors/packet-ipv6.c:2458:9
    #57 0x7fb821bd54d3 in dissect_ipv6 wireshark/epan/dissectors/packet-ipv6.c:2406:5
    #58 0x7fb823376be0 in call_dissector_through_handle wireshark/epan/packet.c:706:9
    #59 0x7fb823376be0 in call_dissector_work wireshark/epan/packet.c:791
    #60 0x7fb823372cb8 in call_dissector_only wireshark/epan/packet.c:3141:8
    #61 0x7fb823372cb8 in call_dissector_with_data wir