#945092 Security: tcpxtract crash (heap-buffer-overflow) on Buster/Stretch/Jessie

Package:
tcpxtract
Source:
tcpxtract
Description:
extract files from network traffic based on file signatures
Submitter:
Antoine Cervoise
Date:
2024-04-23 08:51:02 UTC
Severity:
normal
Tags:
#945092#5
Date:
2019-11-19 13:50:19 UTC
From:
To:
Dear Maintainer,

tcpxtract when analyzing the following file (crash.tcpdump). Crash exists on Debian Jessie, Stretch and Buster (Bullseye and Sid seems to use the same package as Buster).

Versions are 1.0.1-13 (buster), 1.0.1-11 (stretch), 1.0.1-8 (jessie)

Package info (jessie):
$ dpkg --list tcpxtract
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                   Version          Architecture     Description
+++-======================-================-================-=================================================
ii  tcpxtract              1.0.1-8          amd64            extracts files from network traffic based on file

Package info (stretch):
$ dpkg --list tcpxtract
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                   Version          Architecture     Description
+++-======================-================-================-=================================================
ii  tcpxtract              1.0.1-11         amd64            extract files from network traffic based on file

Package info (buster):
$ dpkg --list tcpxtract
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name           Version      Architecture Description
+++-==============-============-============-===========================================================
ii  tcpxtract      1.0.1-13     amd64        extract files from network traffic based on file signatures

File info:
$ md5sum crash.tcpdump
26514548ac04f47ec610e255d15d5e2f  crash.tcpdump
$ sha1sum crash.tcpdump
c5a0377d1c4f9f5f6d9c60839ed1b44388b90525  crash.tcpdump
$ sha256sum crash.tcpdump
eca339965dc64154029c7b8f3dd64e7710d04cde3850666df0b025a07c3fbad3  crash.tcpdump
$ file crash.tcpdump
crash.tcpdump: tcpdump capture file (little-endian) - version 2.4 (Ethernet, capture length 262144)


Crash (same result on Buster, Stretch and Jessie):
$ tcpxtract -f crash.tcpdump
Segmentation fault

Trace from crash (gdb with peda plugin) - Buster:
Program received signal SIGSEGV, Segmentation fault.

[----------------------------------registers-----------------------------------]
RAX: 0x7ffff79e903a --> 0x10000013f2f
RBX: 0x37bfc6
RCX: 0x0
RDX: 0x0
RSI: 0x0
RDI: 0x7ffff7d6ac40 --> 0x0
RBP: 0x5555555a3b40 --> 0x5555555a41a0 --> 0x5555555a3c20 --> 0x0
RSP: 0x7fffffffdf20 --> 0x7fffffffdf40 --> 0x5555555a3c60 --> 0x5555555a3c90 --> 0x5555555a3cc0 --> 0x5555555a3cf0 (--> ...)
RIP: 0x555555558b9c (movzx  r12d,BYTE PTR [rax+rbx*1])
R8 : 0x5555555a41a0 --> 0x5555555a3c20 --> 0x0
R9 : 0x0
R10: 0x0
R11: 0x30 ('0')
R12: 0x555555567ee0 --> 0x0
R13: 0x37bfc6
R14: 0x0
R15: 0x5555555a41a0 --> 0x5555555a3c20 --> 0x0
EFLAGS: 0x10282 (carry parity adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x555555558b90:    mov    rax,QWORD PTR [rsp+0x8]
   0x555555558b95:    mov    r15,QWORD PTR [rbp+0x0]
   0x555555558b99:    mov    r13d,ebx
=> 0x555555558b9c:    movzx  r12d,BYTE PTR [rax+rbx*1]
   0x555555558ba1:    test   r15,r15
   0x555555558ba4:    jne    0x555555558bc4
   0x555555558ba6:    jmp    0x555555558c10
   0x555555558ba8:    nop    DWORD PTR [rax+rax*1+0x0]
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffdf20 --> 0x7fffffffdf40 --> 0x5555555a3c60 --> 0x5555555a3c90 --> 0x5555555a3cc0 --> 0x5555555a3cf0 (--> ...)
0008| 0x7fffffffdf28 --> 0x7ffff79e903a --> 0x10000013f2f
0016| 0x7fffffffdf30 --> 0xffffffffffffffdc
0024| 0x7fffffffdf38 --> 0x5555555635b0 --> 0x0
0032| 0x7fffffffdf40 --> 0x5555555a3c60 --> 0x5555555a3c90 --> 0x5555555a3cc0 --> 0x5555555a3cf0 --> 0x5555555a3d20 (--> ...)
0040| 0x7fffffffdf48 --> 0x8292a0abdb3fa400
0048| 0x7fffffffdf50 --> 0xffffffffffffffdc
0056| 0x7fffffffdf58 --> 0x7ffff79e903a --> 0x10000013f2f
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x0000555555558b9c in ?? ()

Trace from crash (gdb with peda plugin) - Stretch:
[----------------------------------registers-----------------------------------]
RAX: 0x7ffff7f9a03a --> 0x10000013f2f
RBX: 0x555555765c90 --> 0x0
RCX: 0x7ffff7b91b08 --> 0x0
RDX: 0x0
RSI: 0x0
RDI: 0x0
RBP: 0x44fc6
RSP: 0x7fffffffdef0 --> 0x7fffffffdf10 --> 0x0
RIP: 0x555555557c2f (movzx  ebx,BYTE PTR [rax+rbp*1])
R8 : 0x5555557a17e0 --> 0x5555557a1820 --> 0x0
R9 : 0x20 (' ')
R10: 0x5555557a1890 --> 0x4000000000006
R11: 0x40000
R12: 0x5555557a17c0 --> 0x5555557a17e0 --> 0x5555557a1820 --> 0x0
R13: 0x44fc6
R14: 0x0
R15: 0x5555557a17e0 --> 0x5555557a1820 --> 0x0
EFLAGS: 0x10202 (carry parity adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x555555557c24:    mov    rax,QWORD PTR [rsp+0x8]
   0x555555557c29:    mov    r13d,ebp
   0x555555557c2c:    test   r15,r15
=> 0x555555557c2f:    movzx  ebx,BYTE PTR [rax+rbp*1]
   0x555555557c33:    jne    0x555555557c66
   0x555555557c35:    jmp    0x555555557c9e
   0x555555557c37:    nop    WORD PTR [rax+rax*1+0x0]
   0x555555557c40:    mov    edx,DWORD PTR [rsi+0x4]
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffdef0 --> 0x7fffffffdf10 --> 0x0
0008| 0x7fffffffdef8 --> 0x7ffff7f9a03a --> 0x10000013f2f
0016| 0x7fffffffdf00 --> 0xffffffffffffffdc
0024| 0x7fffffffdf08 --> 0x555555761360 --> 0x0
0032| 0x7fffffffdf10 --> 0x0
0040| 0x7fffffffdf18 --> 0xf72fab7b70145400
0048| 0x7fffffffdf20 --> 0x55555575b1d0 --> 0x5555557a1780 --> 0x0
0056| 0x7fffffffdf28 --> 0x7ffff7f9a03a --> 0x10000013f2f
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x0000555555557c2f in ?? ()

Trace from crash (gdb with peda plugin) - Jessie:
Program received signal SIGSEGV, Segmentation fault.

[----------------------------------registers-----------------------------------]
RAX: 0x43fc6
RBX: 0x649870 --> 0x649890 --> 0x6498b0 --> 0x0
RCX: 0x3
RDX: 0x0
RSI: 0x7ffff7b96620 --> 0x0
RDI: 0x0
RBP: 0x43fc6
RSP: 0x7fffffffe020 --> 0x649830 --> 0x0
RIP: 0x40374f (movzx  r15d,BYTE PTR [r12+rax*1])
R8 : 0x649890 --> 0x6498b0 --> 0x0
R9 : 0x649890 --> 0x6498b0 --> 0x0
R10: 0x7fffffffdde0 --> 0x0
R11: 0x7ffff786d600 (<__GI___libc_free>:    mov    rax,QWORD PTR [rip+0x3288e1]        # 0x7ffff7b95ee8)
R12: 0x7ffff7f9a03a --> 0x10000013f2f
R13: 0x649890 --> 0x6498b0 --> 0x0
R14: 0x0
R15: 0x0
EFLAGS: 0x10282 (carry parity adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x403742:    nop    WORD PTR [rax+rax*1+0x0]
   0x403748:    mov    r13,QWORD PTR [rbx]
   0x40374b:    mov    DWORD PTR [rsp+0xc],ebp
=> 0x40374f:    movzx  r15d,BYTE PTR [r12+rax*1]
   0x403754:    test   r13,r13
   0x403757:    jne    0x40376c
   0x403759:    jmp    0x4037a0
   0x40375b:    nop    DWORD PTR [rax+rax*1+0x0]
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffe020 --> 0x649830 --> 0x0
0008| 0x7fffffffe028 --> 0x43fc6f7f9a03a
0016| 0x7fffffffe030 --> 0x60a360 --> 0x0
0024| 0x7fffffffe038 --> 0xffffffffffffffdc
0032| 0x7fffffffe040 --> 0xc2132400
0040| 0x7fffffffe048 --> 0x0
0048| 0x7fffffffe050 --> 0x7ffff7f9a010 --> 0x8b85d1684afd7ba
0056| 0x7fffffffe058 --> 0x649830 --> 0x0
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x000000000040374f in ?? ()

Trace from crash (Debian package with patches compiled with Address Sanitizer) - only for Buster (result is similar on Jessie and Stretch):
Note: for Buster compilation using make failed, I had to run manually the last compilation command manually by adding -ll
==16635==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f1157def800 at pc 0x556ed42c2831 bp 0x7ffc20e59310 sp 0x7ffc20e59308
READ of size 1 at 0x7f1157def800 thread T0
    #0 0x556ed42c2830 in search (/home/ace/fuzz/tcpxtract/asan/tcpxtract_1.0.1.orig/tcpxtract-1.0.1/tcpxtract+0xd830)
    #1 0x556ed42bae45 in got_packet (/home/ace/fuzz/tcpxtract/asan/tcpxtract_1.0.1.orig/tcpxtract-1.0.1/tcpxtract+0x5e45)
    #2 0x7f115a7ab328  (/lib/x86_64-linux-gnu/libpcap.so.0.8+0x1f328)
    #3 0x556ed42bbb59 in main (/home/ace/fuzz/tcpxtract/asan/tcpxtract_1.0.1.orig/tcpxtract-1.0.1/tcpxtract+0x6b59)
    #4 0x7f115a5ef09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
    #5 0x556ed42ba489 in _start (/home/ace/fuzz/tcpxtract/asan/tcpxtract_1.0.1.orig/tcpxtract-1.0.1/tcpxtract+0x5489)

0x7f1157def800 is located 0 bytes to the right of 262144-byte region [0x7f1157daf800,0x7f1157def800)
allocated by thread T0 here:
    #0 0x7f115aab7330 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:86
    #1 0x7f115a7abec1  (/lib/x86_64-linux-gnu/libpcap.so.0.8+0x1fec1)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/ace/fuzz/tcpxtract/asan/tcpxtract_1.0.1.orig/tcpxtract-1.0.1/tcpxtract+0xd830) in search
Shadow bytes around the buggy address:
  0x0fe2aafb5eb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe2aafb5ec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe2aafb5ed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe2aafb5ee0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe2aafb5ef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0fe2aafb5f00:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe2aafb5f10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe2aafb5f20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe2aafb5f30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe2aafb5f40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe2aafb5f50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==16635==ABORTING

About LTS versions:
As buffer overflow is considered as a security issue, this crash may be patch regarding the LTS of Debian Jessie & Strecth.

Kind regards,
Antoine
#945092#10
Date:
2024-04-22 04:27:32 UTC
From:
To:
Dear Maintainers,

It seems that the crash was caused by the uninitialized pointer
'srch_machine'. The code checks it for NULL before initializing it
properly. Since the pointer was not initialized to NULL occasionally
the initialization did not happen and the code tried to access
uninitialized memory.

I was wondering if the attached patch could be accepted as a solution
for this issue?

Best Regards,
 Vladimir.
#945092#17
Date:
2024-04-23 08:49:04 UTC
From:
To:
Hi,

I have also run into a related issue caused by the ambiguous lexer
definition - it matched whitespace using dot rule and the
configuration file failed to parse.
I have used the attached patch to resolve it.

Thank you for considering the patch!

Best Regards,
 Vladimir.