Heap Out-of-Bounds Write in libevent via AF_UNIX accept POC Analysis

Vulnerability Overview Vulnerability Name: Heap out-of-bounds write in reachable via AF_UNIX accept Description: This vulnerability exists in the function, which calls to copy a caller-provided length into a 28-byte field when building libevent (in default release builds). When using socket paths, the kernel-provided returned by and the socket address are written by the kernel. For an listener, a peer may increase the length of an abstract namespace name to 108 bytes, causing to report , with the kernel padding 110 bytes of attacker-controlled content. These 110 bytes are subsequently copied via into a 28-byte field, resulting in a controlled linear heap overflow exceeding the 74 bytes allocated for , plus an 8-byte pointer (which is later dereferenced in ). Scope of Impact Affected Versions: 2 GB available RAM: >2 GB Network: Required to pull and apt packages Container: Debian: 12 (bookworm) glibc: 2.36-9+deb12u8 gcc: 12.2.0 gdb: 13.1 OpenSSL: 3.0.20-1~deb12u1 AddressSanitizer: Bundled with gcc 12 2. Source Code Acquisition 3. Create Build Environment 3.1 Dockerfile 3.2 libevent Build Script ```bash #!/bin/bash set -eux cd /work for BUILD in asan prod; do mkdir -p /tmp/build-${BUILD} cd /tmp/build-${BUILD} cmake \ -DCMAKE_BUILD_TYPE=Debug \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \ -DENABLE_EXAMPLES=OFF \ -DENABLE_LIBRARIES=ON \ -DENABLE_STATIC=ON \ -DENABLE_SHARED=OFF \ -DENABLE_OPENSSL=ON \ -DENABLE_PTHREADS=ON \ -DENABLE_TESTS=OFF \ -DENABLE_SAMPLES=OFF \

Goal Reached Thanks to every supporter — we hit 100%!

Heap Out-of-Bounds Write in libevent via AF_UNIX accept POC Analysis

More from this source