Bug 11826 - Wireshark heap-based out-of-bounds read in AirPDcapDecryptWPABroadcastKey
Summary: Wireshark heap-based out-of-bounds read in AirPDcapDecryptWPABroadcastKey
Status: RESOLVED FIXED
Alias: None
Product: Wireshark
Classification: Unclassified
Component: Dissection engine (libwireshark) (show other bugs)
Version: Git
Hardware: All All
: Low Major (vote)
Target Milestone: ---
Assignee: Bugzilla Administrator
URL:
Depends on:
Blocks:
 
Reported: 2015-11-30 15:42 UTC by Mateusz Jurczyk
Modified: 2016-02-05 20:40 UTC (History)
2 users (show)

See Also:

Attachments
Reproducers. (2.89 KB, application/zip)
2015-11-30 15:42 UTC, Mateusz Jurczyk 		Details
unzip file 1 (1.48 KB, application/vnd.tcpdump.pcap)
2015-12-20 15:31 UTC, Michael Mann 		Details
unzip file 2 (5.35 KB, application/vnd.tcpdump.pcap)
2015-12-20 15:32 UTC, Michael Mann 		Details
Show Obsolete (1) Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Mateusz Jurczyk 2015-11-30 15:42:31 UTC 
Created attachment 14086 [details]
Reproducers.

Build Information:
Wireshark git master.
--
The following crash due to a heap-based out-of-bounds read can be observed in an ASAN build of Wireshark (current git master), by feeding a malformed file to tshark ("$ ./tshark -nVxr /path/to/file"):

Attached are two files which trigger the crash.

--- cut ---
==6158==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200035b1df at pc 0x0000004aaf85 bp 0x7ffcdca29930 sp 0x7ffcdca290e0
READ of size 16 at 0x60200035b1df thread T0
    #0 0x4aaf84 in __asan_memcpy llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:393
    #1 0x7fc44e6a216a in AirPDcapDecryptWPABroadcastKey wireshark/epan/crypt/airpdcap.c:454:5
    #2 0x7fc44e6a0fd6 in AirPDcapRsna4WHandshake wireshark/epan/crypt/airpdcap.c:1405:21
    #3 0x7fc44e698b78 in AirPDcapScanForKeys wireshark/epan/crypt/airpdcap.c:563:13
    #4 0x7fc44e69749b in AirPDcapPacketProcess wireshark/epan/crypt/airpdcap.c:695:21
    #5 0x7fc44f596013 in dissect_ieee80211_common wireshark/epan/dissectors/packet-ieee80211.c:17767:9
    #6 0x7fc44f569dae in dissect_ieee80211 wireshark/epan/dissectors/packet-ieee80211.c:18375:10
    #7 0x7fc44e4f8cc1 in call_dissector_through_handle wireshark/epan/packet.c:616:8
    #8 0x7fc44e4eb5ea in call_dissector_work wireshark/epan/packet.c:691:9
    #9 0x7fc44e4f52be in call_dissector_only wireshark/epan/packet.c:2662:8
    #10 0x7fc44e4e6ccf in call_dissector_with_data wireshark/epan/packet.c:2675:8
    #11 0x7fc44f51c032 in dissect_wlan_radio wireshark/epan/dissectors/packet-ieee80211-radio.c:975:10
    #12 0x7fc44e4f8cc1 in call_dissector_through_handle wireshark/epan/packet.c:616:8
    #13 0x7fc44e4eb5ea in call_dissector_work wireshark/epan/packet.c:691:9
    #14 0x7fc44e4f52be in call_dissector_only wireshark/epan/packet.c:2662:8
    #15 0x7fc44e4e6ccf in call_dissector_with_data wireshark/epan/packet.c:2675:8
    #16 0x7fc44f52d965 in dissect_radiotap wireshark/epan/dissectors/packet-ieee80211-radiotap.c:1796:2
    #17 0x7fc44e4f8cc1 in call_dissector_through_handle wireshark/epan/packet.c:616:8
    #18 0x7fc44e4eb5ea in call_dissector_work wireshark/epan/packet.c:691:9
    #19 0x7fc44e4eadbd in dissector_try_uint_new wireshark/epan/packet.c:1148:9
    #20 0x7fc44f1fa5f6 in dissect_frame wireshark/epan/dissectors/packet-frame.c:500:11
    #21 0x7fc44e4f8cc1 in call_dissector_through_handle wireshark/epan/packet.c:616:8
    #22 0x7fc44e4eb5ea in call_dissector_work wireshark/epan/packet.c:691:9
    #23 0x7fc44e4f52be in call_dissector_only wireshark/epan/packet.c:2662:8
    #24 0x7fc44e4e6ccf in call_dissector_with_data wireshark/epan/packet.c:2675:8
    #25 0x7fc44e4e633b in dissect_record wireshark/epan/packet.c:501:3
    #26 0x7fc44e4943c9 in epan_dissect_run_with_taps wireshark/epan/epan.c:373:2
    #27 0x5264eb in process_packet wireshark/tshark.c:3728:5
    #28 0x51f960 in load_cap_file wireshark/tshark.c:3484:11
    #29 0x515daf in main wireshark/tshark.c:2197:13

0x60200035b1df is located 0 bytes to the right of 15-byte region [0x60200035b1d0,0x60200035b1df)
allocated by thread T0 here:
    #0 0x4c0bc8 in malloc llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:40
    #1 0x7fc446a1c610 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4e610)

SUMMARY: AddressSanitizer: heap-buffer-overflow llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:393 in __asan_memcpy
Shadow bytes around the buggy address:
  0x0c04800635e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c04800635f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480063600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480063610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480063620: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c0480063630: fa fa fa fa fa fa fa fa fa fa 00[07]fa fa 00 00
  0x0c0480063640: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c0480063650: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c0480063660: fa fa 00 00 fa fa 00 00 fa fa fd fd fa fa 01 fa
  0x0c0480063670: fa fa 06 fa fa fa fd fd fa fa fd fd fa fa 00 07
  0x0c0480063680: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==6158==ABORTING
--- cut ---

This bug is subject to a 90 day disclosure deadline. If 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public.
Comment 1 Michael Mann 2015-12-01 03:41:09 UTC 
Certainly looks like it could be a duplicate of (at least) one of the existing Buildbot fuzz bugs.
Comment 2 Michael Mann 2015-12-20 15:31:59 UTC 
Created attachment 14163 [details]
unzip file 1
Comment 3 Michael Mann 2015-12-20 15:32:34 UTC 
Created attachment 14164 [details]
unzip file 2

unzip files for the fuzzbots
Comment 4 Michael Mann 2015-12-20 15:32:58 UTC 
Making public for Gerrit hooks
Comment 5 Gerrit Code Review 2015-12-21 05:10:20 UTC 
Change 12743 merged by Michael Mann:
[airpdcap] check the length of the WPA broadcast key we calculated

https://code.wireshark.org/review/12743
Comment 6 Gerrit Code Review 2015-12-21 05:23:48 UTC 
Change 12769 had a related patch set uploaded by Michael Mann:
[airpdcap] check the length of the WPA broadcast key we calculated

https://code.wireshark.org/review/12769
Comment 7 Gerrit Code Review 2015-12-21 05:31:04 UTC 
Change 12771 had a related patch set uploaded by Michael Mann:
[airpdcap] check the length of the WPA broadcast key we calculated

https://code.wireshark.org/review/12771
Comment 8 Gerrit Code Review 2015-12-21 08:11:30 UTC 
Change 12769 merged by Alexis La Goutte:
[airpdcap] check the length of the WPA broadcast key we calculated

https://code.wireshark.org/review/12769
Comment 9 Gerrit Code Review 2015-12-21 08:11:57 UTC 
Change 12771 merged by Alexis La Goutte:
[airpdcap] check the length of the WPA broadcast key we calculated

https://code.wireshark.org/review/12771
Comment 10 Gerrit Code Review 2016-02-05 20:40:47 UTC 
Change 13762 had a related patch set uploaded by Balint Reczey:
[airpdcap] check the length of the WPA broadcast key we calculated

https://code.wireshark.org/review/13762
Comment 11 Gerrit Code Review 2016-02-05 20:40:54 UTC 
Change 13762 merged by Balint Reczey:
[airpdcap] check the length of the WPA broadcast key we calculated

https://code.wireshark.org/review/13762