Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86396774

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=806

The following crashes due to a static out-of-bounds memory read can be observed in an ASAN build of Wireshark (current git master), by feeding a malformed file to tshark ("$ ./tshark -nVxr /path/to/file"):

--- cut ---
==666==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7fa5e68bd620 at pc 0x7fa5dc525eab bp 0x7ffd5938ec40 sp 0x7ffd5938ec38
READ of size 4 at 0x7fa5e68bd620 thread T0
    #0 0x7fa5dc525eaa in dissect_zcl_pwr_prof_pwrprofnotif wireshark/epan/dissectors/packet-zbee-zcl-general.c:10832:25
    #1 0x7fa5dc512afc in dissect_zbee_zcl_pwr_prof wireshark/epan/dissectors/packet-zbee-zcl-general.c:10549:21
    #2 0x7fa5d9d89911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #3 0x7fa5d9d7b57a in call_dissector_work wireshark/epan/packet.c:731:9
    #4 0x7fa5d9d85a1e in call_dissector_only wireshark/epan/packet.c:2764:8
    #5 0x7fa5d9d768ff in call_dissector_with_data wireshark/epan/packet.c:2777:8
    #6 0x7fa5dc4f777c in dissect_zbee_zcl wireshark/epan/dissectors/packet-zbee-zcl.c:881:13
    #7 0x7fa5d9d89911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #8 0x7fa5d9d7b57a in call_dissector_work wireshark/epan/packet.c:731:9
    #9 0x7fa5d9d85a1e in call_dissector_only wireshark/epan/packet.c:2764:8
    #10 0x7fa5d9d768ff in call_dissector_with_data wireshark/epan/packet.c:2777:8
    #11 0x7fa5dc4d0d60 in dissect_zbee_apf wireshark/epan/dissectors/packet-zbee-aps.c:1705:9
    #12 0x7fa5d9d89911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #13 0x7fa5d9d7b57a in call_dissector_work wireshark/epan/packet.c:731:9
    #14 0x7fa5d9d85a1e in call_dissector_only wireshark/epan/packet.c:2764:8
    #15 0x7fa5d9d768ff in call_dissector_with_data wireshark/epan/packet.c:2777:8
    #16 0x7fa5dc4d04fa in dissect_zbee_aps wireshark/epan/dissectors/packet-zbee-aps.c:1055:13
    #17 0x7fa5d9d89911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #18 0x7fa5d9d7b57a in call_dissector_work wireshark/epan/packet.c:731:9
    #19 0x7fa5d9d85a1e in call_dissector_only wireshark/epan/packet.c:2764:8
    #20 0x7fa5d9d768ff in call_dissector_with_data wireshark/epan/packet.c:2777:8
    #21 0x7fa5dc4da910 in dissect_zbee_nwk_full wireshark/epan/dissectors/packet-zbee-nwk.c:732:9
    #22 0x7fa5dc4d419a in dissect_zbee_nwk wireshark/epan/dissectors/packet-zbee-nwk.c:762:9
    #23 0x7fa5dc4d5fb7 in dissect_zbee_nwk_heur wireshark/epan/dissectors/packet-zbee-nwk.c:409:5
    #24 0x7fa5d9d83bbb in dissector_try_heuristic wireshark/epan/packet.c:2390:7
    #25 0x7fa5daf6591b in dissect_ieee802154_common wireshark/epan/dissectors/packet-ieee802154.c:1524:21
    #26 0x7fa5daf5756a in dissect_ieee802154_nofcs wireshark/epan/dissectors/packet-ieee802154.c:751:5
    #27 0x7fa5d9d89911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #28 0x7fa5d9d7b57a in call_dissector_work wireshark/epan/packet.c:731:9
    #29 0x7fa5d9d7ad4d in dissector_try_uint_new wireshark/epan/packet.c:1190:9
    #30 0x7fa5dab8c105 in dissect_frame wireshark/epan/dissectors/packet-frame.c:492:11
    #31 0x7fa5d9d89911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #32 0x7fa5d9d7b57a in call_dissector_work wireshark/epan/packet.c:731:9
    #33 0x7fa5d9d85a1e in call_dissector_only wireshark/epan/packet.c:2764:8
    #34 0x7fa5d9d768ff in call_dissector_with_data wireshark/epan/packet.c:2777:8
    #35 0x7fa5d9d75cd4 in dissect_record wireshark/epan/packet.c:539:3
    #36 0x7fa5d9d28db9 in epan_dissect_run_with_taps wireshark/epan/epan.c:376:2
    #37 0x52ef3f in process_packet wireshark/tshark.c:3727:5
    #38 0x52830c in load_cap_file wireshark/tshark.c:3483:11
    #39 0x51e67c in main wireshark/tshark.c:2192:13

0x7fa5e68bd620 is located 32 bytes to the left of global variable 'ett_zbee_zcl_appl_ctrl_func' defined in 'packet-zbee-zcl-general.c:11520:13' (0x7fa5e68bd640) of size 128
0x7fa5e68bd620 is located 0 bytes to the right of global variable 'ett_zbee_zcl_pwr_prof_enphases' defined in 'packet-zbee-zcl-general.c:10389:13' (0x7fa5e68bd5e0) of size 64
SUMMARY: AddressSanitizer: global-buffer-overflow wireshark/epan/dissectors/packet-zbee-zcl-general.c:10832:25 in dissect_zcl_pwr_prof_pwrprofnotif
Shadow bytes around the buggy address:
  0x0ff53cd0fa70: f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 00 00 00 00
  0x0ff53cd0fa80: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0ff53cd0fa90: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff53cd0faa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9
  0x0ff53cd0fab0: f9 f9 f9 f9 00 00 04 f9 f9 f9 f9 f9 00 00 00 00
=>0x0ff53cd0fac0: 00 00 00 00[f9]f9 f9 f9 00 00 00 00 00 00 00 00
  0x0ff53cd0fad0: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 f9 f9 f9
  0x0ff53cd0fae0: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff53cd0faf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff53cd0fb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff53cd0fb10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==666==ABORTING
--- cut ---

--- cut ---
==695==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7feb11013620 at pc 0x7feb06c7b825 bp 0x7ffd6fe96b00 sp 0x7ffd6fe96af8
READ of size 4 at 0x7feb11013620 thread T0
    #0 0x7feb06c7b824 in dissect_zcl_pwr_prof_enphsschednotif wireshark/epan/dissectors/packet-zbee-zcl-general.c:10745:25
    #1 0x7feb06c68ba8 in dissect_zbee_zcl_pwr_prof wireshark/epan/dissectors/packet-zbee-zcl-general.c:10563:21
    #2 0x7feb044df911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #3 0x7feb044d157a in call_dissector_work wireshark/epan/packet.c:731:9
    #4 0x7feb044dba1e in call_dissector_only wireshark/epan/packet.c:2764:8
    #5 0x7feb044cc8ff in call_dissector_with_data wireshark/epan/packet.c:2777:8
    #6 0x7feb06c4d77c in dissect_zbee_zcl wireshark/epan/dissectors/packet-zbee-zcl.c:881:13
    #7 0x7feb044df911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #8 0x7feb044d157a in call_dissector_work wireshark/epan/packet.c:731:9
    #9 0x7feb044dba1e in call_dissector_only wireshark/epan/packet.c:2764:8
    #10 0x7feb044cc8ff in call_dissector_with_data wireshark/epan/packet.c:2777:8
    #11 0x7feb06c26d60 in dissect_zbee_apf wireshark/epan/dissectors/packet-zbee-aps.c:1705:9
    #12 0x7feb044df911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #13 0x7feb044d157a in call_dissector_work wireshark/epan/packet.c:731:9
    #14 0x7feb044dba1e in call_dissector_only wireshark/epan/packet.c:2764:8
    #15 0x7feb044cc8ff in call_dissector_with_data wireshark/epan/packet.c:2777:8
    #16 0x7feb06c264fa in dissect_zbee_aps wireshark/epan/dissectors/packet-zbee-aps.c:1055:13
    #17 0x7feb044df911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #18 0x7feb044d157a in call_dissector_work wireshark/epan/packet.c:731:9
    #19 0x7feb044dba1e in call_dissector_only wireshark/epan/packet.c:2764:8
    #20 0x7feb044cc8ff in call_dissector_with_data wireshark/epan/packet.c:2777:8
    #21 0x7feb06c30910 in dissect_zbee_nwk_full wireshark/epan/dissectors/packet-zbee-nwk.c:732:9
    #22 0x7feb06c2a19a in dissect_zbee_nwk wireshark/epan/dissectors/packet-zbee-nwk.c:762:9
    #23 0x7feb06c2bfb7 in dissect_zbee_nwk_heur wireshark/epan/dissectors/packet-zbee-nwk.c:409:5
    #24 0x7feb044d9bbb in dissector_try_heuristic wireshark/epan/packet.c:2390:7
    #25 0x7feb056bb91b in dissect_ieee802154_common wireshark/epan/dissectors/packet-ieee802154.c:1524:21
    #26 0x7feb056ad56a in dissect_ieee802154_nofcs wireshark/epan/dissectors/packet-ieee802154.c:751:5
    #27 0x7feb044df911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #28 0x7feb044d157a in call_dissector_work wireshark/epan/packet.c:731:9
    #29 0x7feb044d0d4d in dissector_try_uint_new wireshark/epan/packet.c:1190:9
    #30 0x7feb052e2105 in dissect_frame wireshark/epan/dissectors/packet-frame.c:492:11
    #31 0x7feb044df911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #32 0x7feb044d157a in call_dissector_work wireshark/epan/packet.c:731:9
    #33 0x7feb044dba1e in call_dissector_only wireshark/epan/packet.c:2764:8
    #34 0x7feb044cc8ff in call_dissector_with_data wireshark/epan/packet.c:2777:8
    #35 0x7feb044cbcd4 in dissect_record wireshark/epan/packet.c:539:3
    #36 0x7feb0447edb9 in epan_dissect_run_with_taps wireshark/epan/epan.c:376:2
    #37 0x52ef3f in process_packet wireshark/tshark.c:3727:5
    #38 0x52830c in load_cap_file wireshark/tshark.c:3483:11
    #39 0x51e67c in main wireshark/tshark.c:2192:13

0x7feb11013620 is located 32 bytes to the left of global variable 'ett_zbee_zcl_appl_ctrl_func' defined in 'packet-zbee-zcl-general.c:11520:13' (0x7feb11013640) of size 128
0x7feb11013620 is located 0 bytes to the right of global variable 'ett_zbee_zcl_pwr_prof_enphases' defined in 'packet-zbee-zcl-general.c:10389:13' (0x7feb110135e0) of size 64
SUMMARY: AddressSanitizer: global-buffer-overflow wireshark/epan/dissectors/packet-zbee-zcl-general.c:10745:25 in dissect_zcl_pwr_prof_enphsschednotif
Shadow bytes around the buggy address:
  0x0ffde21fa670: f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 00 00 00 00
  0x0ffde21fa680: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0ffde21fa690: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ffde21fa6a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9
  0x0ffde21fa6b0: f9 f9 f9 f9 00 00 04 f9 f9 f9 f9 f9 00 00 00 00
=>0x0ffde21fa6c0: 00 00 00 00[f9]f9 f9 f9 00 00 00 00 00 00 00 00
  0x0ffde21fa6d0: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 f9 f9 f9
  0x0ffde21fa6e0: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ffde21fa6f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ffde21fa700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ffde21fa710: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==695==ABORTING
--- cut ---

The crash was reported at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12358. Attached are two files which trigger the crash.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39750.zip