oss-security - Re: CVE-2024-22857: Heap Based Buffer overflow in zlog library

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID:
 <AM0PR05MB666089CAC3BA067F6E86816EFD5F2@AM0PR05MB6660.eurprd05.prod.outlook.com>
Date: Thu, 29 Feb 2024 07:13:38 +0000
From: Ali Raza Mumtaz <raza.mumtaz@...yx.com>
To: Solar Designer <solar@...nwall.com>
CC: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>, Faran
 Abdullah <faran.abdullah@...yx.com>
Subject: Re: CVE-2024-22857: Heap Based Buffer overflow in zlog
 library

Size of record_name is MAXLEN_PATH(1024) + 1 but file_path may have data upto MAXLEN_CFG_LINE(MAXLEN_PATH*4) + 1. So a check was missing in zlog_rule_new() while copying the record_name from file_path + 1 which caused the buffer overflow. An attacker can exploit this vulnerability to overwrite the zlog_record_fn record_func function pointer to get arbitrary code execution.

patch: https://github.com/HardySimpson/zlog/pull/251/commits/77d8af3b368b564605f3ab34ad9b0ed6ead9b380

[https://avatars.githubusercontent.com/u/70605579?s=400&v=4]<https://github.com/HardySimpson/zlog/pull/251/commits/77d8af3b368b564605f3ab34ad9b0ed6ead9b380>
CVE-2024-22857: buffer overflow patched by alirazamumtaz · Pull Request #251 · HardySimpson/zlog<https://github.com/HardySimpson/zlog/pull/251/commits/77d8af3b368b564605f3ab34ad9b0ed6ead9b380>
Size of record_name is MAXLEN_PATH(1024) + 1 but file_path may have data upto MAXLEN_CFG_LINE(MAXLEN_PATH*4) + 1. So a check was missing in zlog_rule_new() while copying the record_name from file_p...
github.com

________________________________
From: Solar Designer <solar@...nwall.com>
Sent: Wednesday, February 28, 2024 8:04 PM
To: Ali Raza Mumtaz <raza.mumtaz@...yx.com>
Cc: oss-security@...ts.openwall.com <oss-security@...ts.openwall.com>; Faran Abdullah <faran.abdullah@...yx.com>
Subject: Re: [oss-security] CVE-2024-22857: Heap Based Buffer overflow in zlog library

[You don't often get email from solar@...nwall.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

Hi,

On Wed, Feb 28, 2024 at 09:24:29AM +0000, Ali Raza Mumtaz wrote:
> We have found a vulnerability in zlog that is essentially a heap-based buffer overflow leading to denial of service and arbitrary code execution.
>
> We have been trying to contact the maintainer of this project for almost three months and haven't received any response. Additionally, we have reserved a CVE number with MITRE (CVE-2024-22857) and now we intend to publish it.
>
> We have a working PoC that provides code execution, along with a detailed blog regarding this vulnerability (which, of course, remains unpublished).

Thank you for bringing this to oss-security.  Normally, we expect
postings to include actual vulnerability detail right away, but I
understand the circumstances here are different.

I found that you also brought this up in:

https://github.com/HardySimpson/zlog/issues/250

and I've just posted some comments to there.  It appears that zlog
author Hardy Simpson is currently mostly inactive on GitHub and with the
project - only one contribution in a year (on December 4).  However,
another person was merging pull requests recently, so maybe they can
help, as I am asking in a comment I posted.

Please remember to add the full vulnerability detail in a reply to this
oss-security thread on the same day that the same information is made
public elsewhere (e.g., in a GitHub pull request).

Please also do this soon (e.g., in a couple of weeks from now) even in
case communication with project maintainers doesn't start or fails, so
that distros and users have a chance to know the risk and patch the
issue on their own.

Thanks,

Alexander
CONFIDENTIAL: The contents of this email and any attachments are confidential and are intended solely for the addressee. Information is legally privileged. This transmission, sent in trust, is for the sole purpose of delivery to the intended recipient. Do not distribute, email, fax, or transfer to third parties via any mechanism without prior approval of Ebryx. Do not share any information herein with third parties unless cited from public sources.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.