Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Stack buffer overflow in dlt_logstorage_storage_dir_info() #896

Copy link
Copy link

Description

@cryptcrack
Issue body actions

Summary

A stack-based buffer overflow exists in the DLT Offline Logstorage feature of dlt-daemon.

When Offline Logstorage is enabled, dlt-daemon scans the configured logstorage directory to collect existing log files. During this process, dlt_logstorage_storage_dir_info() concatenates the directory component and the scanned file name into a fixed-size stack buffer using strcat() without validating the combined length.

Vulnerable Code

int dlt_logstorage_storage_dir_info(DltLogStorageUserConfig *file_config,
                                    char *path,
                                    DltLogStorageFilterConfig *config)

char tmpfile[DLT_OFFLINE_LOGSTORAGE_MAX_LOG_FILE_LEN + 1] = { '\0' };

if (dir != NULL) {
    /* Append directory path */
    strcat(tmpfile, dir);
    strcat(tmpfile, "/");
}

strcat(tmpfile, files[i]->d_name);
(*tmp)->name = strdup(tmpfile);

Root Cause

The root cause is unsafe concatenation of filesystem-controlled file names into a fixed-size stack buffer.

dlt_logstorage_storage_dir_info() calls scandir() on the Offline Logstorage directory:

cnt = scandir(storage_path, &files, 0, alphasort);

Each matching directory entry is processed based on only a weak prefix/delimiter check:

if (strncmp(files[i]->d_name, file_name, len) == 0) {
    ...
    if (files[i]->d_name[len] == file_config->logfile_delimiter) {
        ...
    }
}

As a result, a long directory component from the file= configuration and a long matching file name in the logstorage directory can overflow the 121-byte stack buffer.

Log

=================================================================
==2563690==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f6a75002789 at pc 0x5a4fa650e3ae bp 0x7ffd5b64f1b0 sp 0x7ffd5b64e950
WRITE of size 186 at 0x7f6a75002789 thread T0
    #0 0x5a4fa650e3ad in strcat (/root/dlt-daemon/latest/bin_asan/bin/dlt-daemon+0xf63ad) (BuildId: 27b9b5c2d7523d42651101a79aff9643ec011a07)
    #1 0x5a4fa66087eb in dlt_logstorage_storage_dir_info /root/dlt-daemon/latest/code/src/offlinelogstorage/dlt_offline_logstorage_behavior.c:437:13
    #2 0x5a4fa66093c7 in dlt_logstorage_open_log_file /root/dlt-daemon/latest/code/src/offlinelogstorage/dlt_offline_logstorage_behavior.c:555:13
    #3 0x5a4fa660ae94 in dlt_logstorage_prepare_on_msg /root/dlt-daemon/latest/code/src/offlinelogstorage/dlt_offline_logstorage_behavior.c
    #4 0x5a4fa66039b1 in dlt_logstorage_write /root/dlt-daemon/latest/code/src/offlinelogstorage/dlt_offline_logstorage.c:2603:19
    #5 0x5a4fa65af133 in dlt_daemon_logstorage_write /root/dlt-daemon/latest/code/src/daemon/dlt_daemon_offline_logstorage.c:1427:24
    #6 0x5a4fa657ad4c in dlt_daemon_client_send /root/dlt-daemon/latest/code/src/daemon/dlt_daemon_client.c:244:30
    #7 0x5a4fa656bcd1 in dlt_daemon_log_internal /root/dlt-daemon/latest/code/src/daemon/dlt-daemon.c:2881:9
    #8 0x5a4fa6569be8 in main /root/dlt-daemon/latest/code/src/daemon/dlt-daemon.c:1677:5
    #9 0x7f6a769181c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #10 0x7f6a7691828a in __libc_start_main csu/../csu/libc-start.c:360:3
    #11 0x5a4fa648c654 in _start (/root/dlt-daemon/latest/bin_asan/bin/dlt-daemon+0x74654) (BuildId: 27b9b5c2d7523d42651101a79aff9643ec011a07)

Address 0x7f6a75002789 is located in stack of thread T0 at offset 1929 in frame
    #0 0x5a4fa6607cbf in dlt_logstorage_storage_dir_info /root/dlt-daemon/latest/code/src/offlinelogstorage/dlt_offline_logstorage_behavior.c:307

  This frame has 7 object(s):
    [32, 40) 'eptr.i' (line 273)
    [64, 72) 'files' (line 313)
    [96, 1244) 'storage_path' (line 317)
    [1376, 1477) 'file_name' (line 318)
    [1520, 1621) 'tmpdir' (line 331)
    [1664, 1765) 'tmpfile' (line 332)
    [1808, 1929) 'tmpfile142' (line 431) <== Memory access at offset 1929 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow (/root/dlt-daemon/latest/bin_asan/bin/dlt-daemon+0xf63ad) (BuildId: 27b9b5c2d7523d42651101a79aff9643ec011a07) in strcat
Shadow bytes around the buggy address:
  0x7f6a75002500: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00
  0x7f6a75002580: 00 00 00 00 00 00 00 00 05 f2 f2 f2 f2 f2 f8 f8
  0x7f6a75002600: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 f2
  0x7f6a75002680: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f2 f2 f2
  0x7f6a75002700: f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7f6a75002780: 00[01]f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
  0x7f6a75002800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7f6a75002880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7f6a75002900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7f6a75002980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7f6a75002a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==2563690==ABORTING

Impact

  • Potential Code Execution
  • Stack-based buffer overflow
  • Denial of Service
Reactions are currently unavailable

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    Morty Proxy This is a proxified and sanitized view of the page, visit original site.