SGMiner / CGMiner / BFGMiner Heap Overflow

2014.07.23
Risk: High
Local: No
Remote: Yes
CWE: CWE-119


Ogólna skala CVSS: 10/10
Znaczenie: 10/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Pełny
Wpływ na integralność: Pełny
Wpływ na dostępność: Pełny

Vulnerability title: Invalid Handling of Length Parameter in Stratum mining.notify Message Leads to Heap Overflow CVE: CVE-2014-4502 Affected version: SGMiner before 4.2.2, CGMiner before 4.3.5, BFGMiner before 4.1.0 Reported by: Mick Ayzenberg of Deja vu Security Details: A pool responds to a "mining.subscribe" Stratum request with a list of parameters the application will use when mining. Two of these parameters are "Extranonce1", a hex-encoded string, and "Extranonce2_size", the length of a nonce the miner can increment. A malicious pool or an attacker who is in middle of a valid Stratum connection can respond to a "mining.subscribe" request from a client with arbitrary Extranonce1 and Extranonce2_size parameters. An attacker can then send a valid "mining.notify" request to initiate mining. The "mining.notify" message specifies parameters "coinb1" and "coinb2", hex encoded strings of arbitrary length. Cgminer, Sgminer, and Bfgminer will use the values provided to calculate memory requirements for a valid block and copy parameters into this allocated space. By setting the value of "Extranonc2_size" to be negative or large, an attacker can force the "parse_notify" function to allocate less memory than expected and overwrite memory in the heap.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top