Repository: the-tcpdump-group/tcpdump

Issue #547: CVE-2016-7940 Out of bound read in stp_print_bridge_id()
Created: 2016-10-29T23:04:25Z
Out of bound read in stp_print_bridge_id()
Tested on Git HEAD:  e2adb16
To reproduce: tcpdump -r heap_bufover_1.pcap

ASAN output:
reading from file heap_bufover_1.pcap, link-type EN10MB (Ethernet)
07:27:12.808464432 30:30:30:30:30:30 (oui Unknown) > 30:30:30:30:30:30 (oui Unknown), ethertype Unknown (0x3030), length 808464432:
        0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
        0x0010:  3030 3030                                0000
07:27:12.808464432 30:30:30:30:30:30 (oui Unknown) > 30:30:30:30:30:30 (oui Unknown), ethertype Unknown (0x3030), length 808464432:
        0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
        0x0010:  3030 3030                                0000
=================================================================
==11241==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400000dfb2 at pc 0x000000681afb bp 0x7fffac76c530 sp 0x7fffac76c528
READ of size 1 at 0x60400000dfb2 thread T0
    #0 0x681afa in stp_print_bridge_id XYZ/tcpdump/./print-stp.c:94:14
    #1 0x681afa in stp_print_config_bpdu XYZ/tcpdump/./print-stp.c:106
    #2 0x67fdec in stp_print XYZ/tcpdump/./print-stp.c:404:9
    #3 0x5cd44d in llc_print XYZ/tcpdump/./print-llc.c:278:3
    #4 0x565d27 in ether_print XYZ/tcpdump/./print-ether.c:171:16
    #5 0x501b12 in pretty_print_packet XYZ/tcpdump/./print.c:339:18
    #6 0x4eebeb in print_packet XYZ/tcpdump/./tcpdump.c:2492:2
    #7 0x7adaf7 in pcap_offline_read XYZ/libpcap/./savefile.c:527:4
    #8 0x6b6f4c in pcap_loop XYZ/libpcap/./pcap.c:890:8
    #9 0x4ea1db in main XYZ/tcpdump/./tcpdump.c:1996:12
    #10 0x7f268906a82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #11 0x419ff8 in _start (/usr/local/sbin/tcpdump+0x419ff8)

0x60400000dfb2 is located 0 bytes to the right of 34-byte region [0x60400000df90,0x60400000dfb2)
allocated by thread T0 here:
    #0 0x4b880c in malloc /home/development/llvm/3.9.0/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64:3
    #1 0x7af103 in pcap_check_header XYZ/libpcap/./sf-pcap.c:401:14
    #2 0x7acf22 in pcap_fopen_offline_with_tstamp_precision XYZ/libpcap/./savefile.c:400:7
    #3 0x7accaf in pcap_open_offline_with_tstamp_precision XYZ/libpcap/./savefile.c:307:6
    #4 0x7f268906a82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow XYZ/tcpdump/./print-stp.c:94:14 in stp_print_bridge_id
Shadow bytes around the buggy address:
  0x0c087fff9ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff9bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff9bc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff9bd0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c087fff9be0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
=>0x0c087fff9bf0: fa fa 00 00 00 00[02]fa fa fa 00 00 00 00 00 01
  0x0c087fff9c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff9c10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff9c20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff9c30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff9c40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==11241==ABORTING

Duplicate issue #548: Out of bound read in EXTRACT_16BITS()
Created: 2016-10-29T23:08:57Z
Out of bound read in EXTRACT_16BITS()
Tested on Git HEAD:  e2adb16
To reproduce: tcpdump -r heap_bufover_2.pcap

ASAN output:
reading from file heap_bufover_2.pcap, link-type EN10MB (Ethernet)
22:45:39.856336 IP [|ip]
22:45:39.856371 IP [|ip]
=================================================================
==15985==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000ef31 at pc 0x000000680f6c bp 0x7ffc0cddcaf0 sp 0x7ffc0cddcae8
READ of size 2 at 0x60300000ef31 thread T0
    #0 0x680f6b in EXTRACT_16BITS XYZ/tcpdump/./extract.h:144:20
    #1 0x680f6b in stp_print XYZ/tcpdump/./print-stp.c:378
    #2 0x5cd44d in llc_print XYZ/tcpdump/./print-llc.c:278:3
    #3 0x565d27 in ether_print XYZ/tcpdump/./print-ether.c:171:16
    #4 0x501b12 in pretty_print_packet XYZ/tcpdump/./print.c:339:18
    #5 0x4eebeb in print_packet XYZ/tcpdump/./tcpdump.c:2492:2
    #6 0x7adaf7 in pcap_offline_read XYZ/libpcap/./savefile.c:527:4
    #7 0x6b6f4c in pcap_loop XYZ/libpcap/./pcap.c:890:8
    #8 0x4ea1db in main XYZ/tcpdump/./tcpdump.c:1996:12
    #9 0x7fd63165e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #10 0x419ff8 in _start (/usr/local/sbin/tcpdump+0x419ff8)

0x60300000ef31 is located 0 bytes to the right of 17-byte region [0x60300000ef20,0x60300000ef31)
allocated by thread T0 here:
    #0 0x4b880c in malloc /home/development/llvm/3.9.0/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64:3
    #1 0x7af103 in pcap_check_header XYZ/libpcap/./sf-pcap.c:401:14
    #2 0x7acf22 in pcap_fopen_offline_with_tstamp_precision XYZ/libpcap/./savefile.c:400:7
    #3 0x7accaf in pcap_open_offline_with_tstamp_precision XYZ/libpcap/./savefile.c:307:6
    #4 0x7fd63165e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow XYZ/tcpdump/./extract.h:144:20 in EXTRACT_16BITS
Shadow bytes around the buggy address:
  0x0c067fff9d90: 00 00 00 00 fa fa 00 00 00 01 fa fa 00 00 04 fa
  0x0c067fff9da0: fa fa 00 00 07 fa fa fa 00 00 00 01 fa fa 00 00
  0x0c067fff9db0: 00 02 fa fa 00 00 00 01 fa fa 00 00 06 fa fa fa
  0x0c067fff9dc0: 00 00 00 fa fa fa 00 00 07 fa fa fa 00 00 06 fa
  0x0c067fff9dd0: fa fa 00 00 07 fa fa fa 00 00 00 00 fa fa fd fd
=>0x0c067fff9de0: fd fa fa fa 00 00[01]fa fa fa 00 00 04 fa fa fa
  0x0c067fff9df0: 00 00 05 fa fa fa 00 00 04 fa fa fa 00 00 04 fa
  0x0c067fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==15985==ABORTING

Closing comment (2024-05-16T17:29:10Z): Duplicate of #547