oss-security - CVE request: PulseAudio crash due to empty UDP packet

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <538EDB62.5090509@gmail.com>
Date: Wed, 04 Jun 2014 14:40:02 +0600
From: "Alexander E. Patrakov" <patrakov@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: PulseAudio crash due to empty UDP packet

Hello.

If one has module-rtp-recv loaded into PulseAudio, then a remote 
attacker can crash this instance of PulseAudio by sending an empty UDP 
packet to the multicast address where module-rtp-recv has decided to 
receive the stream due to a previous SAP/SDP announcement.

When PulseAudio crashes, it says to the log:

E: [alsa-sink-ALC275 Analog] memblock.c: Assertion 'b' failed at 
.../pulseaudio-5.0/src/pulsecore/memblock.c:596, function 
pa_memblock_unref(). Aborting.

So this doesn't look exploitable - just a DoS attack, and PulseAudio 
usually gets respawned anyway.

The problem has been reported upstream, but got no response yet:

http://lists.freedesktop.org/archives/pulseaudio-discuss/2014-May/020740.html

The problematic code is in the pa_rtp_recv() function, in the handling 
of the result of the FIONREAD ioctl. It existed since the introduction 
of the module, i.e. since 2006-04-16 (git commit f1ddf0523), which is 
before version 1.0.

The problem I found is that the function just returns immediately, 
without even attempting to read the zero-sized packet. I don't know how 
this later leads to the failed assertion.

http://cgit.freedesktop.org/pulseaudio/pulseaudio/tree/src/modules/rtp/rtp.c#n185

A patch has been sent, but not reviewed and thus not accepted, and thus 
the problem still exists in git master:

http://lists.freedesktop.org/archives/pulseaudio-discuss/2014-May/020741.html

I have also tested SAP/SDP handling for the same type of vulnerability, 
but PulseAudio survived an empty UDP packet there just fine.

-- 
Alexander E. Patrakov

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.