Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86395031

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=645

The following crash due to a use-after-free condition can be observed in an ASAN build of Wireshark (current git master), by feeding a malformed file to tshark ("$ ./tshark -nVxr /path/to/file"):

Attached are three files which trigger the crash.

--- cut ---
==5117==ERROR: AddressSanitizer: heap-use-after-free on address 0x61b00001e3b2 at pc 0x000000499bad bp 0x7ffd2111f650 sp 0x7ffd2111ee00
READ of size 4 at 0x61b00001e3b2 thread T0
    #0 0x499bac in memcmp llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:416
    #1 0x37949bc in addresses_equal wireshark/epan/dissectors/./../address.h:140:26
    #2 0x379389a in rsvp_equal wireshark/epan/dissectors/packet-rsvp.c:1886:13
    #3 0x7f77e4ae95ef in g_hash_table_lookup (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x385ef)
    #4 0x3796e2d in dissect_rsvp_common wireshark/epan/dissectors/packet-rsvp.c:7531:37
    #5 0x37930d4 in dissect_rsvp wireshark/epan/dissectors/packet-rsvp.c:7553:5
    #6 0xaf3794 in call_dissector_through_handle wireshark/epan/packet.c:616:8
    #7 0xae5692 in call_dissector_work wireshark/epan/packet.c:691:9
    #8 0xae4e1d in dissector_try_uint_new wireshark/epan/packet.c:1148:9
    #9 0x29c5318 in ip_try_dissect wireshark/epan/dissectors/packet-ip.c:2001:7
    #10 0x29d0521 in dissect_ip_v4 wireshark/epan/dissectors/packet-ip.c:2485:10
    #11 0xaf3794 in call_dissector_through_handle wireshark/epan/packet.c:616:8
    #12 0xae5692 in call_dissector_work wireshark/epan/packet.c:691:9
    #13 0xae4e1d in dissector_try_uint_new wireshark/epan/packet.c:1148:9
    #14 0xae5a38 in dissector_try_uint wireshark/epan/packet.c:1174:9
    #15 0x24e0824 in dissect_ethertype wireshark/epan/dissectors/packet-ethertype.c:307:21
    #16 0xaf3794 in call_dissector_through_handle wireshark/epan/packet.c:616:8
    #17 0xae5692 in call_dissector_work wireshark/epan/packet.c:691:9
    #18 0xaefb1b in call_dissector_only wireshark/epan/packet.c:2662:8
    #19 0xae09f3 in call_dissector_with_data wireshark/epan/packet.c:2675:8
    #20 0x24dc752 in dissect_eth_common wireshark/epan/dissectors/packet-eth.c:545:5
    #21 0x24d499a in dissect_eth_maybefcs wireshark/epan/dissectors/packet-eth.c:828:5
    #22 0xaf3794 in call_dissector_through_handle wireshark/epan/packet.c:616:8
    #23 0xae5692 in call_dissector_work wireshark/epan/packet.c:691:9
    #24 0xae4e1d in dissector_try_uint_new wireshark/epan/packet.c:1148:9
    #25 0x25dca12 in dissect_frame wireshark/epan/dissectors/packet-frame.c:500:11
    #26 0xaf3794 in call_dissector_through_handle wireshark/epan/packet.c:616:8
    #27 0xae5692 in call_dissector_work wireshark/epan/packet.c:691:9
    #28 0xaefb1b in call_dissector_only wireshark/epan/packet.c:2662:8
    #29 0xae09f3 in call_dissector_with_data wireshark/epan/packet.c:2675:8
    #30 0xadffde in dissect_record wireshark/epan/packet.c:501:3
    #31 0xab6d0d in epan_dissect_run_with_taps wireshark/epan/epan.c:373:2
    #32 0x53c91b in process_packet wireshark/tshark.c:3728:5
    #33 0x535d90 in load_cap_file wireshark/tshark.c:3484:11
    #34 0x52c1df in main wireshark/tshark.c:2197:13

0x61b00001e3b2 is located 50 bytes inside of 1500-byte region [0x61b00001e380,0x61b00001e95c)
freed by thread T0 here:
    #0 0x4d7380 in realloc llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:61
    #1 0x7f77e4aff6ae in g_realloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4e6ae)
    #2 0x9d71b7 in wtap_read_packet_bytes wireshark/wiretap/wtap.c:1419:2
    #3 0x89ee21 in libpcap_read_packet wireshark/wiretap/libpcap.c:722:7
    #4 0x8991f4 in libpcap_read wireshark/wiretap/libpcap.c:619:9
    #5 0x9d64c2 in wtap_read wireshark/wiretap/wtap.c:1314:7
    #6 0x535c1a in load_cap_file wireshark/tshark.c:3479:12
    #7 0x52c1df in main wireshark/tshark.c:2197:13

previously allocated by thread T0 here:
    #0 0x4d6ff8 in __interceptor_malloc llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:40
    #1 0x7f77e4aff610 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4e610)
    #2 0x83fff6 in wtap_open_offline wireshark/wiretap/file_access.c:1105:2
    #3 0x53214d in cf_open wireshark/tshark.c:4195:9
    #4 0x52bc7e in main wireshark/tshark.c:2188:9

SUMMARY: AddressSanitizer: heap-use-after-free llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:416 in memcmp
Shadow bytes around the buggy address:
  0x0c367fffbc20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c367fffbc30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c367fffbc40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c367fffbc50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c367fffbc60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c367fffbc70: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd
  0x0c367fffbc80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c367fffbc90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c367fffbca0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c367fffbcb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c367fffbcc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==5117==ABORTING
--- cut ---

The crash was reported at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11793. Attached are three files which trigger the crash.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39002.zip