[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20180324234829.01cc3edb@pc1>
Date: Sat, 24 Mar 2018 23:48:29 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Stack buffer overflow in WolfSSL before 3.13.0
https://blog.fuzzing-project.org/63-Stack-buffer-overflow-in-WolfSSL-before-3.13.0.html
During some tests of TLS libraries I found a stack buffer overflow
vulnerability in the WolfSSL library. Finding this one was surprisingly
simple: I had a wolfssl server that was compiled with address sanitizer
and ran the SSL Labs test against it.
The bug happens in the parsing of the signature hash algorithm list
that is sent in a ClientHello and is basically a textbook stack buffer
overflow. WolfSSL simply tries to store that in an array with 32
elements. If one sends more than 32 hash algorithms it overflows.
With the SSL Labs scan the bug only causes WolfSSL to terminate if it's
compiled with address sanitizer, but if one sends a very large list of
hash algorithms it also crashes in a normal compile. In situations
where WolfSSL is used without ASLR this bug is probably trivially
exploitable.
I have created a simple bash proof of concept [1] (using netcat and xxd)
that crashes a WolfSSL server.
The bug was fixed in this commit [2] and in version 3.13.0 of WolfSSL.
[1] https://github.com/hannob/wolfoverflow
[2]
https://github.com/wolfSSL/wolfssl/pull/1231/commits/9f7e40ad5c8097ff38d7caff4a9989db260981cc
--
Hanno Böck
https://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
