Summary
A stack-based buffer overflow exists in the DLT Offline Logstorage feature of dlt-daemon.
When Offline Logstorage is enabled, dlt-daemon scans the configured logstorage directory to collect existing log files. During this process, dlt_logstorage_storage_dir_info() concatenates the directory component and the scanned file name into a fixed-size stack buffer using strcat() without validating the combined length.
Vulnerable Code
int dlt_logstorage_storage_dir_info(DltLogStorageUserConfig *file_config,
char *path,
DltLogStorageFilterConfig *config)
char tmpfile[DLT_OFFLINE_LOGSTORAGE_MAX_LOG_FILE_LEN + 1] = { '\0' };
if (dir != NULL) {
/* Append directory path */
strcat(tmpfile, dir);
strcat(tmpfile, "/");
}
strcat(tmpfile, files[i]->d_name);
(*tmp)->name = strdup(tmpfile);
Root Cause
The root cause is unsafe concatenation of filesystem-controlled file names into a fixed-size stack buffer.
dlt_logstorage_storage_dir_info() calls scandir() on the Offline Logstorage directory:
cnt = scandir(storage_path, &files, 0, alphasort);
Each matching directory entry is processed based on only a weak prefix/delimiter check:
if (strncmp(files[i]->d_name, file_name, len) == 0) {
...
if (files[i]->d_name[len] == file_config->logfile_delimiter) {
...
}
}
As a result, a long directory component from the file= configuration and a long matching file name in the logstorage directory can overflow the 121-byte stack buffer.
Log
=================================================================
==2563690==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f6a75002789 at pc 0x5a4fa650e3ae bp 0x7ffd5b64f1b0 sp 0x7ffd5b64e950
WRITE of size 186 at 0x7f6a75002789 thread T0
#0 0x5a4fa650e3ad in strcat (/root/dlt-daemon/latest/bin_asan/bin/dlt-daemon+0xf63ad) (BuildId: 27b9b5c2d7523d42651101a79aff9643ec011a07)
#1 0x5a4fa66087eb in dlt_logstorage_storage_dir_info /root/dlt-daemon/latest/code/src/offlinelogstorage/dlt_offline_logstorage_behavior.c:437:13
#2 0x5a4fa66093c7 in dlt_logstorage_open_log_file /root/dlt-daemon/latest/code/src/offlinelogstorage/dlt_offline_logstorage_behavior.c:555:13
#3 0x5a4fa660ae94 in dlt_logstorage_prepare_on_msg /root/dlt-daemon/latest/code/src/offlinelogstorage/dlt_offline_logstorage_behavior.c
#4 0x5a4fa66039b1 in dlt_logstorage_write /root/dlt-daemon/latest/code/src/offlinelogstorage/dlt_offline_logstorage.c:2603:19
#5 0x5a4fa65af133 in dlt_daemon_logstorage_write /root/dlt-daemon/latest/code/src/daemon/dlt_daemon_offline_logstorage.c:1427:24
#6 0x5a4fa657ad4c in dlt_daemon_client_send /root/dlt-daemon/latest/code/src/daemon/dlt_daemon_client.c:244:30
#7 0x5a4fa656bcd1 in dlt_daemon_log_internal /root/dlt-daemon/latest/code/src/daemon/dlt-daemon.c:2881:9
#8 0x5a4fa6569be8 in main /root/dlt-daemon/latest/code/src/daemon/dlt-daemon.c:1677:5
#9 0x7f6a769181c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#10 0x7f6a7691828a in __libc_start_main csu/../csu/libc-start.c:360:3
#11 0x5a4fa648c654 in _start (/root/dlt-daemon/latest/bin_asan/bin/dlt-daemon+0x74654) (BuildId: 27b9b5c2d7523d42651101a79aff9643ec011a07)
Address 0x7f6a75002789 is located in stack of thread T0 at offset 1929 in frame
#0 0x5a4fa6607cbf in dlt_logstorage_storage_dir_info /root/dlt-daemon/latest/code/src/offlinelogstorage/dlt_offline_logstorage_behavior.c:307
This frame has 7 object(s):
[32, 40) 'eptr.i' (line 273)
[64, 72) 'files' (line 313)
[96, 1244) 'storage_path' (line 317)
[1376, 1477) 'file_name' (line 318)
[1520, 1621) 'tmpdir' (line 331)
[1664, 1765) 'tmpfile' (line 332)
[1808, 1929) 'tmpfile142' (line 431) <== Memory access at offset 1929 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow (/root/dlt-daemon/latest/bin_asan/bin/dlt-daemon+0xf63ad) (BuildId: 27b9b5c2d7523d42651101a79aff9643ec011a07) in strcat
Shadow bytes around the buggy address:
0x7f6a75002500: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00
0x7f6a75002580: 00 00 00 00 00 00 00 00 05 f2 f2 f2 f2 f2 f8 f8
0x7f6a75002600: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 f2
0x7f6a75002680: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f2 f2 f2
0x7f6a75002700: f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7f6a75002780: 00[01]f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
0x7f6a75002800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7f6a75002880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7f6a75002900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7f6a75002980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7f6a75002a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2563690==ABORTING
Impact
- Potential Code Execution
- Stack-based buffer overflow
- Denial of Service
Summary
A stack-based buffer overflow exists in the DLT Offline Logstorage feature of dlt-daemon.
When Offline Logstorage is enabled, dlt-daemon scans the configured logstorage directory to collect existing log files. During this process, dlt_logstorage_storage_dir_info() concatenates the directory component and the scanned file name into a fixed-size stack buffer using strcat() without validating the combined length.
Vulnerable Code
Root Cause
The root cause is unsafe concatenation of filesystem-controlled file names into a fixed-size stack buffer.
dlt_logstorage_storage_dir_info() calls scandir() on the Offline Logstorage directory:
Each matching directory entry is processed based on only a weak prefix/delimiter check:
As a result, a long directory component from the file= configuration and a long matching file name in the logstorage directory can overflow the 121-byte stack buffer.
Log
Impact