Vulnerability title: Invalid Handling of Length Parameter in Stratum
mining.notify Message Leads to Heap Overflow
CVE: CVE-2014-4502
Affected version: SGMiner before 4.2.2, CGMiner before 4.3.5, BFGMiner
before 4.1.0
Reported by: Mick Ayzenberg of Deja vu Security
Details:
A pool responds to a "mining.subscribe" Stratum request with a list of
parameters the application will use when mining. Two of these
parameters are "Extranonce1", a hex-encoded string, and
"Extranonce2_size", the length of a nonce the miner can increment.
A malicious pool or an attacker who is in middle of a valid Stratum
connection can respond to a "mining.subscribe" request from a client
with arbitrary Extranonce1 and Extranonce2_size parameters.
An attacker can then send a valid "mining.notify" request to initiate
mining. The "mining.notify" message specifies parameters "coinb1" and
"coinb2", hex encoded strings of arbitrary length.
Cgminer, Sgminer, and Bfgminer will use the values provided to
calculate memory requirements for a valid block and copy parameters
into this allocated space. By setting the value of "Extranonc2_size"
to be negative or large, an attacker can force the "parse_notify"
function to allocate less memory than expected and overwrite memory in
the heap.
