扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 |
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=806 The following crashes due to a static out-of-bounds memory read can be observed in an ASAN build of Wireshark (current git master), by feeding a malformed file to tshark ("$ ./tshark -nVxr /path/to/file"): --- cut --- ==666==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7fa5e68bd620 at pc 0x7fa5dc525eab bp 0x7ffd5938ec40 sp 0x7ffd5938ec38 READ of size 4 at 0x7fa5e68bd620 thread T0 #0 0x7fa5dc525eaa in dissect_zcl_pwr_prof_pwrprofnotif wireshark/epan/dissectors/packet-zbee-zcl-general.c:10832:25 #1 0x7fa5dc512afc in dissect_zbee_zcl_pwr_prof wireshark/epan/dissectors/packet-zbee-zcl-general.c:10549:21 #2 0x7fa5d9d89911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #3 0x7fa5d9d7b57a in call_dissector_work wireshark/epan/packet.c:731:9 #4 0x7fa5d9d85a1e in call_dissector_only wireshark/epan/packet.c:2764:8 #5 0x7fa5d9d768ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #6 0x7fa5dc4f777c in dissect_zbee_zcl wireshark/epan/dissectors/packet-zbee-zcl.c:881:13 #7 0x7fa5d9d89911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #8 0x7fa5d9d7b57a in call_dissector_work wireshark/epan/packet.c:731:9 #9 0x7fa5d9d85a1e in call_dissector_only wireshark/epan/packet.c:2764:8 #10 0x7fa5d9d768ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #11 0x7fa5dc4d0d60 in dissect_zbee_apf wireshark/epan/dissectors/packet-zbee-aps.c:1705:9 #12 0x7fa5d9d89911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #13 0x7fa5d9d7b57a in call_dissector_work wireshark/epan/packet.c:731:9 #14 0x7fa5d9d85a1e in call_dissector_only wireshark/epan/packet.c:2764:8 #15 0x7fa5d9d768ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #16 0x7fa5dc4d04fa in dissect_zbee_aps wireshark/epan/dissectors/packet-zbee-aps.c:1055:13 #17 0x7fa5d9d89911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #18 0x7fa5d9d7b57a in call_dissector_work wireshark/epan/packet.c:731:9 #19 0x7fa5d9d85a1e in call_dissector_only wireshark/epan/packet.c:2764:8 #20 0x7fa5d9d768ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #21 0x7fa5dc4da910 in dissect_zbee_nwk_full wireshark/epan/dissectors/packet-zbee-nwk.c:732:9 #22 0x7fa5dc4d419a in dissect_zbee_nwk wireshark/epan/dissectors/packet-zbee-nwk.c:762:9 #23 0x7fa5dc4d5fb7 in dissect_zbee_nwk_heur wireshark/epan/dissectors/packet-zbee-nwk.c:409:5 #24 0x7fa5d9d83bbb in dissector_try_heuristic wireshark/epan/packet.c:2390:7 #25 0x7fa5daf6591b in dissect_ieee802154_common wireshark/epan/dissectors/packet-ieee802154.c:1524:21 #26 0x7fa5daf5756a in dissect_ieee802154_nofcs wireshark/epan/dissectors/packet-ieee802154.c:751:5 #27 0x7fa5d9d89911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #28 0x7fa5d9d7b57a in call_dissector_work wireshark/epan/packet.c:731:9 #29 0x7fa5d9d7ad4d in dissector_try_uint_new wireshark/epan/packet.c:1190:9 #30 0x7fa5dab8c105 in dissect_frame wireshark/epan/dissectors/packet-frame.c:492:11 #31 0x7fa5d9d89911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #32 0x7fa5d9d7b57a in call_dissector_work wireshark/epan/packet.c:731:9 #33 0x7fa5d9d85a1e in call_dissector_only wireshark/epan/packet.c:2764:8 #34 0x7fa5d9d768ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #35 0x7fa5d9d75cd4 in dissect_record wireshark/epan/packet.c:539:3 #36 0x7fa5d9d28db9 in epan_dissect_run_with_taps wireshark/epan/epan.c:376:2 #37 0x52ef3f in process_packet wireshark/tshark.c:3727:5 #38 0x52830c in load_cap_file wireshark/tshark.c:3483:11 #39 0x51e67c in main wireshark/tshark.c:2192:13 0x7fa5e68bd620 is located 32 bytes to the left of global variable 'ett_zbee_zcl_appl_ctrl_func' defined in 'packet-zbee-zcl-general.c:11520:13' (0x7fa5e68bd640) of size 128 0x7fa5e68bd620 is located 0 bytes to the right of global variable 'ett_zbee_zcl_pwr_prof_enphases' defined in 'packet-zbee-zcl-general.c:10389:13' (0x7fa5e68bd5e0) of size 64 SUMMARY: AddressSanitizer: global-buffer-overflow wireshark/epan/dissectors/packet-zbee-zcl-general.c:10832:25 in dissect_zcl_pwr_prof_pwrprofnotif Shadow bytes around the buggy address: 0x0ff53cd0fa70: f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 00 00 00 00 0x0ff53cd0fa80: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 00 00 00 00 0x0ff53cd0fa90: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff53cd0faa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 0x0ff53cd0fab0: f9 f9 f9 f9 00 00 04 f9 f9 f9 f9 f9 00 00 00 00 =>0x0ff53cd0fac0: 00 00 00 00[f9]f9 f9 f9 00 00 00 00 00 00 00 00 0x0ff53cd0fad0: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 f9 f9 f9 0x0ff53cd0fae0: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff53cd0faf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff53cd0fb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff53cd0fb10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone:fb Freed heap region: fd Stack left redzone:f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return:f5 Stack use after scope: f8 Global redzone:f9 Global init order: f6 Poisoned by user:f7 Container overflow:fc Array cookie:ac Intra object redzone:bb ASan internal: fe Left alloca redzone: ca Right alloca redzone:cb ==666==ABORTING --- cut --- --- cut --- ==695==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7feb11013620 at pc 0x7feb06c7b825 bp 0x7ffd6fe96b00 sp 0x7ffd6fe96af8 READ of size 4 at 0x7feb11013620 thread T0 #0 0x7feb06c7b824 in dissect_zcl_pwr_prof_enphsschednotif wireshark/epan/dissectors/packet-zbee-zcl-general.c:10745:25 #1 0x7feb06c68ba8 in dissect_zbee_zcl_pwr_prof wireshark/epan/dissectors/packet-zbee-zcl-general.c:10563:21 #2 0x7feb044df911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #3 0x7feb044d157a in call_dissector_work wireshark/epan/packet.c:731:9 #4 0x7feb044dba1e in call_dissector_only wireshark/epan/packet.c:2764:8 #5 0x7feb044cc8ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #6 0x7feb06c4d77c in dissect_zbee_zcl wireshark/epan/dissectors/packet-zbee-zcl.c:881:13 #7 0x7feb044df911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #8 0x7feb044d157a in call_dissector_work wireshark/epan/packet.c:731:9 #9 0x7feb044dba1e in call_dissector_only wireshark/epan/packet.c:2764:8 #10 0x7feb044cc8ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #11 0x7feb06c26d60 in dissect_zbee_apf wireshark/epan/dissectors/packet-zbee-aps.c:1705:9 #12 0x7feb044df911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #13 0x7feb044d157a in call_dissector_work wireshark/epan/packet.c:731:9 #14 0x7feb044dba1e in call_dissector_only wireshark/epan/packet.c:2764:8 #15 0x7feb044cc8ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #16 0x7feb06c264fa in dissect_zbee_aps wireshark/epan/dissectors/packet-zbee-aps.c:1055:13 #17 0x7feb044df911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #18 0x7feb044d157a in call_dissector_work wireshark/epan/packet.c:731:9 #19 0x7feb044dba1e in call_dissector_only wireshark/epan/packet.c:2764:8 #20 0x7feb044cc8ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #21 0x7feb06c30910 in dissect_zbee_nwk_full wireshark/epan/dissectors/packet-zbee-nwk.c:732:9 #22 0x7feb06c2a19a in dissect_zbee_nwk wireshark/epan/dissectors/packet-zbee-nwk.c:762:9 #23 0x7feb06c2bfb7 in dissect_zbee_nwk_heur wireshark/epan/dissectors/packet-zbee-nwk.c:409:5 #24 0x7feb044d9bbb in dissector_try_heuristic wireshark/epan/packet.c:2390:7 #25 0x7feb056bb91b in dissect_ieee802154_common wireshark/epan/dissectors/packet-ieee802154.c:1524:21 #26 0x7feb056ad56a in dissect_ieee802154_nofcs wireshark/epan/dissectors/packet-ieee802154.c:751:5 #27 0x7feb044df911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #28 0x7feb044d157a in call_dissector_work wireshark/epan/packet.c:731:9 #29 0x7feb044d0d4d in dissector_try_uint_new wireshark/epan/packet.c:1190:9 #30 0x7feb052e2105 in dissect_frame wireshark/epan/dissectors/packet-frame.c:492:11 #31 0x7feb044df911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #32 0x7feb044d157a in call_dissector_work wireshark/epan/packet.c:731:9 #33 0x7feb044dba1e in call_dissector_only wireshark/epan/packet.c:2764:8 #34 0x7feb044cc8ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #35 0x7feb044cbcd4 in dissect_record wireshark/epan/packet.c:539:3 #36 0x7feb0447edb9 in epan_dissect_run_with_taps wireshark/epan/epan.c:376:2 #37 0x52ef3f in process_packet wireshark/tshark.c:3727:5 #38 0x52830c in load_cap_file wireshark/tshark.c:3483:11 #39 0x51e67c in main wireshark/tshark.c:2192:13 0x7feb11013620 is located 32 bytes to the left of global variable 'ett_zbee_zcl_appl_ctrl_func' defined in 'packet-zbee-zcl-general.c:11520:13' (0x7feb11013640) of size 128 0x7feb11013620 is located 0 bytes to the right of global variable 'ett_zbee_zcl_pwr_prof_enphases' defined in 'packet-zbee-zcl-general.c:10389:13' (0x7feb110135e0) of size 64 SUMMARY: AddressSanitizer: global-buffer-overflow wireshark/epan/dissectors/packet-zbee-zcl-general.c:10745:25 in dissect_zcl_pwr_prof_enphsschednotif Shadow bytes around the buggy address: 0x0ffde21fa670: f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 00 00 00 00 0x0ffde21fa680: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 00 00 00 00 0x0ffde21fa690: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 0x0ffde21fa6a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 0x0ffde21fa6b0: f9 f9 f9 f9 00 00 04 f9 f9 f9 f9 f9 00 00 00 00 =>0x0ffde21fa6c0: 00 00 00 00[f9]f9 f9 f9 00 00 00 00 00 00 00 00 0x0ffde21fa6d0: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 f9 f9 f9 0x0ffde21fa6e0: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 0x0ffde21fa6f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ffde21fa700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ffde21fa710: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone:fb Freed heap region: fd Stack left redzone:f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return:f5 Stack use after scope: f8 Global redzone:f9 Global init order: f6 Poisoned by user:f7 Container overflow:fc Array cookie:ac Intra object redzone:bb ASan internal: fe Left alloca redzone: ca Right alloca redzone:cb ==695==ABORTING --- cut --- The crash was reported at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12358. Attached are two files which trigger the crash. Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39750.zip |
体验盒子
