oss-sec mailing list archives
Exploitability of the integer overflows in djbdns 1.05?
From: Georgi Guninski <gguninski () gmail com>
Date: Mon, 1 Jun 2020 09:24:21 +0300
From my blog: https://j.ludost.net/blog/archives/2020/06/01/exploitability_of_the_integer_overflows_in_djbdns_1_05/index.html Exploitability of the integer overflows in djbdns 1.05? TLDR: Are the integer overflows in djbdns 1.05 exploitable? Background: there are integer overflows and memory corruption in the library functions of qmail 1.03. For reference see [1] [2]. Some of the qmail vulnerabilities (integer overflows and negative index???) are present in djbdns 1.05. For example in alloc.c of djbdns: ==== /*@null@*//*@out@*/char *alloc(n) unsigned int n; { char *x; n = ALIGNMENT + n - (n & (ALIGNMENT - 1)); /* XXX: could overflow */ ===== This clearly overflows for n= -1 for example. It is natural to write an integer overflow, but documenting easy to fix security bug is beyond our understanding. Reachability of the bugs is not clear and might require gigabytes of memory to hit the problems by encoding integer in unary. In addition djbns limits the memory usage by |softlimit|, but we are not sure the limits are on all vulnerable programs. An island of tractability could be |alloc(atoi())| or |alloc(size * count)| Is djbdns exploitable by any of the qmail bugs? [1] http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html [2] https://www.openwall.com/lists/oss-security/2020/05/19/8
Current thread:
- Exploitability of the integer overflows in djbdns 1.05? Georgi Guninski (Jun 01)
- Re: Exploitability of the integer overflows in djbdns 1.05? Solar Designer (Jun 01)
- Re: Exploitability of the integer overflows in djbdns 1.05? Georgi Guninski (Jun 02)
- Re: Exploitability of the integer overflows in djbdns 1.05? Georgi Guninski (Jun 03)
- Re: Exploitability of the integer overflows in djbdns 1.05? Solar Designer (Jun 01)