Wireshark – ett_zbee_zcl_pwr_prof_enphases Static Out-of-Bounds Read
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=806 The following crashes due to a static out-of-bounds memory read can be observed in an ASAN build of Wireshark (current git master), by feeding a malformed file to tshark ("$ ./tshark -nVxr /path/to/file"): --- cut --- ==666==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7fa5e68bd620 at pc 0x7fa5dc525eab bp 0x7ffd5938ec40 sp 0x7ffd5938ec38 READ of size 4 at 0x7fa5e68bd620 thread T0 #0 0x7fa5dc525eaa in dissect_zcl_pwr_prof_pwrprofnotif wireshark/epan/dissectors/packet-zbee-zcl-general.c:10832:25 #1 0x7fa5dc512afc in dissect_zbee_zcl_pwr_prof wireshark/epan/dissectors/packet-zbee-zcl-general.c:10549:21 #2 0x7fa5d9d89911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #3 0x7fa5d9d7b57a in call_dissector_work wireshark/epan/packet.c:731:9 #4 0x7fa5d9d85a1e in call_dissector_only wireshark/epan/packet.c:2764:8 #5 0x7fa5d9d768ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #6 0x7fa5dc4f777c in dissect_zbee_zcl wireshark/epan/dissectors/packet-zbee-zcl.c:881:13 #7 0x7fa5d9d89911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #8 0x7fa5d9d7b57a in call_dissector_work wireshark/epan/packet.c:731:9 #9 0x7fa5d9d85a1e in call_dissector_only wireshark/epan/packet.c:2764:8 #10 0x7fa5d9d768ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #11 0x7fa5dc4d0d60 in dissect_zbee_apf wireshark/epan/dissectors/packet-zbee-aps.c:1705:9 #12 0x7fa5d9d89911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #13 0x7fa5d9d7b57a in call_dissector_work wireshark/epan/packet.c:731:9 #14 0x7fa5d9d85a1e in call_dissector_only wireshark/epan/packet.c:2764:8 #15 0x7fa5d9d768ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #16 0x7fa5dc4d04fa in dissect_zbee_aps wireshark/epan/dissectors/packet-zbee-aps.c:1055:13 #17 0x7fa5d9d89911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #18 0x7fa5d9d7b57a in call_dissector_work wireshark/epan/packet.c:731:9 #19 0x7fa5d9d85a1e in call_dissector_only wireshark/epan/packet.c:2764:8 #20 0x7fa5d9d768ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #21 0x7fa5dc4da910 in dissect_zbee_nwk_full wireshark/epan/dissectors/packet-zbee-nwk.c:732:9 #22 0x7fa5dc4d419a in dissect_zbee_nwk wireshark/epan/dissectors/packet-zbee-nwk.c:762:9 #23 0x7fa5dc4d5fb7 in dissect_zbee_nwk_heur wireshark/epan/dissectors/packet-zbee-nwk.c:409:5 #24 0x7fa5d9d83bbb in dissector_try_heuristic wireshark/epan/packet.c:2390:7 #25 0x7fa5daf6591b in dissect_ieee802154_common wireshark/epan/dissectors/packet-ieee802154.c:1524:21 #26 0x7fa5daf5756a in dissect_ieee802154_nofcs wireshark/epan/dissectors/packet-ieee802154.c:751:5 #27 0x7fa5d9d89911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #28 0x7fa5d9d7b57a in call_dissector_work wireshark/epan/packet.c:731:9 #29 0x7fa5d9d7ad4d in dissector_try_uint_new wireshark/epan/packet.c:1190:9 #30 0x7fa5dab8c105 in dissect_frame wireshark/epan/dissectors/packet-frame.c:492:11 #31 0x7fa5d9d89911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #32 0x7fa5d9d7b57a in call_dissector_work wireshark/epan/packet.c:731:9 #33 0x7fa5d9d85a1e in call_dissector_only wireshark/epan/packet.c:2764:8 #34 0x7fa5d9d768ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #35 0x7fa5d9d75cd4 in dissect_record wireshark/epan/packet.c:539:3 #36 0x7fa5d9d28db9 in epan_dissect_run_with_taps wireshark/epan/epan.c:376:2 #37 0x52ef3f in process_packet wireshark/tshark.c:3727:5 #38 0x52830c in load_cap_file wireshark/tshark.c:3483:11 #39 0x51e67c in main wireshark/tshark.c:2192:13 0x7fa5e68bd620 is located 32 bytes to the left of global variable 'ett_zbee_zcl_appl_ctrl_func' defined in 'packet-zbee-zcl-general.c:11520:13' (0x7fa5e68bd640) of size 128 0x7fa5e68bd620 is located 0 bytes to the right of global variable 'ett_zbee_zcl_pwr_prof_enphases' defined in 'packet-zbee-zcl-general.c:10389:13' (0x7fa5e68bd5e0) of size 64 SUMMARY: AddressSanitizer: global-buffer-overflow wireshark/epan/dissectors/packet-zbee-zcl-general.c:10832:25 in dissect_zcl_pwr_prof_pwrprofnotif Shadow bytes around the buggy address: 0x0ff53cd0fa70: f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 00 00 00 00 0x0ff53cd0fa80: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 00 00 00 00 0x0ff53cd0fa90: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff53cd0faa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 0x0ff53cd0fab0: f9 f9 f9 f9 00 00 04 f9 f9 f9 f9 f9 00 00 00 00 =>0x0ff53cd0fac0: 00 00 00 00[f9]f9 f9 f9 00 00 00 00 00 00 00 00 0x0ff53cd0fad0: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 f9 f9 f9 0x0ff53cd0fae0: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff53cd0faf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff53cd0fb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff53cd0fb10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==666==ABORTING --- cut --- --- cut --- ==695==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7feb11013620 at pc 0x7feb06c7b825 bp 0x7ffd6fe96b00 sp 0x7ffd6fe96af8 READ of size 4 at 0x7feb11013620 thread T0 #0 0x7feb06c7b824 in dissect_zcl_pwr_prof_enphsschednotif wireshark/epan/dissectors/packet-zbee-zcl-general.c:10745:25 #1 0x7feb06c68ba8 in dissect_zbee_zcl_pwr_prof wireshark/epan/dissectors/packet-zbee-zcl-general.c:10563:21 #2 0x7feb044df911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #3 0x7feb044d157a in call_dissector_work wireshark/epan/packet.c:731:9 #4 0x7feb044dba1e in call_dissector_only wireshark/epan/packet.c:2764:8 #5 0x7feb044cc8ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #6 0x7feb06c4d77c in dissect_zbee_zcl wireshark/epan/dissectors/packet-zbee-zcl.c:881:13 #7 0x7feb044df911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #8 0x7feb044d157a in call_dissector_work wireshark/epan/packet.c:731:9 #9 0x7feb044dba1e in call_dissector_only wireshark/epan/packet.c:2764:8 #10 0x7feb044cc8ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #11 0x7feb06c26d60 in dissect_zbee_apf wireshark/epan/dissectors/packet-zbee-aps.c:1705:9 #12 0x7feb044df911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #13 0x7feb044d157a in call_dissector_work wireshark/epan/packet.c:731:9 #14 0x7feb044dba1e in call_dissector_only wireshark/epan/packet.c:2764:8 #15 0x7feb044cc8ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #16 0x7feb06c264fa in dissect_zbee_aps wireshark/epan/dissectors/packet-zbee-aps.c:1055:13 #17 0x7feb044df911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #18 0x7feb044d157a in call_dissector_work wireshark/epan/packet.c:731:9 #19 0x7feb044dba1e in call_dissector_only wireshark/epan/packet.c:2764:8 #20 0x7feb044cc8ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #21 0x7feb06c30910 in dissect_zbee_nwk_full wireshark/epan/dissectors/packet-zbee-nwk.c:732:9 #22 0x7feb06c2a19a in dissect_zbee_nwk wireshark/epan/dissectors/packet-zbee-nwk.c:762:9 #23 0x7feb06c2bfb7 in dissect_zbee_nwk_heur wireshark/epan/dissectors/packet-zbee-nwk.c:409:5 #24 0x7feb044d9bbb in dissector_try_heuristic wireshark/epan/packet.c:2390:7 #25 0x7feb056bb91b in dissect_ieee802154_common wireshark/epan/dissectors/packet-ieee802154.c:1524:21 #26 0x7feb056ad56a in dissect_ieee802154_nofcs wireshark/epan/dissectors/packet-ieee802154.c:751:5 #27 0x7feb044df911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #28 0x7feb044d157a in call_dissector_work wireshark/epan/packet.c:731:9 #29 0x7feb044d0d4d in dissector_try_uint_new wireshark/epan/packet.c:1190:9 #30 0x7feb052e2105 in dissect_frame wireshark/epan/dissectors/packet-frame.c:492:11 #31 0x7feb044df911 in call_dissector_through_handle wireshark/epan/packet.c:656:8 #32 0x7feb044d157a in call_dissector_work wireshark/epan/packet.c:731:9 #33 0x7feb044dba1e in call_dissector_only wireshark/epan/packet.c:2764:8 #34 0x7feb044cc8ff in call_dissector_with_data wireshark/epan/packet.c:2777:8 #35 0x7feb044cbcd4 in dissect_record wireshark/epan/packet.c:539:3 #36 0x7feb0447edb9 in epan_dissect_run_with_taps wireshark/epan/epan.c:376:2 #37 0x52ef3f in process_packet wireshark/tshark.c:3727:5 #38 0x52830c in load_cap_file wireshark/tshark.c:3483:11 #39 0x51e67c in main wireshark/tshark.c:2192:13 0x7feb11013620 is located 32 bytes to the left of global variable 'ett_zbee_zcl_appl_ctrl_func' defined in 'packet-zbee-zcl-general.c:11520:13' (0x7feb11013640) of size 128 0x7feb11013620 is located 0 bytes to the right of global variable 'ett_zbee_zcl_pwr_prof_enphases' defined in 'packet-zbee-zcl-general.c:10389:13' (0x7feb110135e0) of size 64 SUMMARY: AddressSanitizer: global-buffer-overflow wireshark/epan/dissectors/packet-zbee-zcl-general.c:10745:25 in dissect_zcl_pwr_prof_enphsschednotif Shadow bytes around the buggy address: 0x0ffde21fa670: f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 00 00 00 00 0x0ffde21fa680: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 00 00 00 00 0x0ffde21fa690: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 0x0ffde21fa6a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 0x0ffde21fa6b0: f9 f9 f9 f9 00 00 04 f9 f9 f9 f9 f9 00 00 00 00 =>0x0ffde21fa6c0: 00 00 00 00[f9]f9 f9 f9 00 00 00 00 00 00 00 00 0x0ffde21fa6d0: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 f9 f9 f9 0x0ffde21fa6e0: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 0x0ffde21fa6f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ffde21fa700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ffde21fa710: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==695==ABORTING --- cut --- The crash was reported at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12358. Attached are two files which trigger the crash. Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39750.zip |