Repository: the-tcpdump-group/tcpdump

Issue #567: CVE-2016-7992 Heap out of bounds read in cip_if_print()
Created: 2016-11-08T08:40:05Z
Heap out of bounds read in cip_if_print()
Tested on Git HEAD:  e2adb16
To reproduce: tcpdump -r oobr_cip_if_print.pcap

ASAN output:
==9996==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000efb1 at pc 0x00000042aa41 bp 0x7fff33512310 sp 0x7fff33511aa0
READ of size 6 at 0x60200000efb1 thread T0
    #0 0x42aa40 in __interceptor_memcmp /home/development/llvm/3.9.0/final/llvm.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:629:7
    #1 0x5483df in cip_if_print XYZ/tcpdump/./print-cip.c:68:6
    #2 0x501b12 in pretty_print_packet XYZ/tcpdump/./print.c:339:18
    #3 0x4eebeb in print_packet XYZ/tcpdump/./tcpdump.c:2492:2
    #4 0x7adaf7 in pcap_offline_read XYZ/libpcap/./savefile.c:527:4
    #5 0x6b6f4c in pcap_loop XYZ/libpcap/./pcap.c:890:8
    #6 0x4ea1db in main XYZ/tcpdump/./tcpdump.c:1996:12
    #7 0x7fcbf1c9b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #8 0x419ff8 in _start (/usr/local/sbin/tcpdump+0x419ff8)

0x60200000efb1 is located 0 bytes to the right of 1-byte region [0x60200000efb0,0x60200000efb1)
allocated by thread T0 here:
    #0 0x4b880c in malloc /home/development/llvm/3.9.0/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64:3
    #1 0x7af103 in pcap_check_header XYZ/libpcap/./sf-pcap.c:401:14
    #2 0x7acf22 in pcap_fopen_offline_with_tstamp_precision XYZ/libpcap/./savefile.c:400:7
    #3 0x7accaf in pcap_open_offline_with_tstamp_precision XYZ/libpcap/./savefile.c:307:6
    #4 0x7fcbf1c9b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/development/llvm/3.9.0/final/llvm.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:629:7 in __interceptor_memcmp
Shadow bytes around the buggy address:
  0x0c047fff9da0: fa fa 00 fa fa fa 00 fa fa fa 00 fa fa fa 07 fa
  0x0c047fff9db0: fa fa 00 fa fa fa 00 fa fa fa 05 fa fa fa 05 fa
  0x0c047fff9dc0: fa fa 07 fa fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff9dd0: fa fa 00 00 fa fa 00 00 fa fa 00 fa fa fa fd fd
  0x0c047fff9de0: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa
=>0x0c047fff9df0: fa fa fd fa fa fa[01]fa fa fa 00 07 fa fa fd fd
  0x0c047fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==9996==ABORTING

Duplicate issue #582: Heap out of bound read in cip_if_print() function in print_cip.c
Created: 2017-01-11T10:54:08Z
Tested on: TcpDump: 4.8.1 and LibPcap: 1.9.0
How to Reproduce: Compile tcpdump in asan mode (-fsanitize=address) and tcpdump -r attachment
Sample attachment Pcap:
heapoverflowreadprint-cip66.tar.gz
Asan Output:
=================================================================
==19898== ERROR: AddressSanitizer: heap-buffer-overflow on address 0xb5c00735 at pc 0x807a342 bp 0xbfcc2c28 sp 0xbfcc2c1c
READ of size 1 at 0xb5c00735 thread T0
#0 0x807a341 in cip_if_print    /tcpdump/4.8.1/gccasan/./print-cip.c:66
#1 0x80582f2 in pretty_print_packet    /tcpdump/tcpdump-4.8.1/./print.c:339
#2 0x8052036 in print_packet    /tcpdump/4.8.1/gccasan/./tcpdump.c:2262
#3 0xb5f9efd5 in pcap_offline_read    /libpcap/gccbuild/./savefile.c:527
#4 0xb5f8ce9e in pcap_loop    /libpcap/gccbuild/./pcap.c:890
#5 0x804f349 in main    /tcpdump/4.8.1/gccasan/./tcpdump.c:1766
#6 0xb5deaaf2 (/lib/i386-linux-gnu/libc.so.6+0x19af2)
#7 0x80515b0 in _start (   /tcpdump/4.8.1/gccasan/tcpdump+0x80515b0)
0xb5c00735 is located 1 bytes to the right of 4-byte region [0xb5c00730,0xb5c00734)
allocated by thread T0 here:
#0 0xb6186854 (/usr/lib/i386-linux-gnu/libasan.so.0+0x16854)
#1 0xb5f9fb49 in pcap_check_header    /libpcap/gccbuild/./sf-pcap.c:401
SUMMARY: AddressSanitizer: heap-buffer-overflow    /tcpdump/4.8.1/gccasan/./print-cip.c:66 cip_if_print
Shadow bytes around the buggy address:
0x36b80090: fa fa 05 fa fa fa 07 fa fa fa 00 fa fa fa 00 00
0x36b800a0: fa fa 00 fa fa fa 00 00 fa fa 00 04 fa fa 00 fa
0x36b800b0: fa fa 00 00 fa fa 00 04 fa fa 00 fa fa fa 00 00
0x36b800c0: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa fd fd
0x36b800d0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
=>0x36b800e0: fa fa fd fa fa fa[04]fa fa fa 00 07 fa fa 00 04
0x36b800f0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa fd fd
0x36b80100: fa fa 04 fa fa fa 04 fa fa fa 00 01 fa fa 00 01
0x36b80110: fa fa 04 fa fa fa 04 fa fa fa 00 01 fa fa 00 01
0x36b80120: fa fa 06 fa fa fa 06 fa fa fa 06 fa fa fa 06 fa
0x36b80130: fa fa 00 03 fa fa 00 03 fa fa 00 01 fa fa 00 01
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable:           00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone:     fa
Heap righ redzone:     fb
Freed Heap region:     fd
Stack left redzone:    f1
Stack mid redzone:     f2
Stack right redzone:   f3
Stack partial redzone: f4
Stack after return:    f5
Stack use after scope: f8
Global redzone:        f9
Global init order:     f6
Poisoned by user:      f7
ASan internal:         fe
==19898== ABORTING
Note: Found using AFL

Closing comment (2024-05-16T17:38:04Z): Duplicate of #567