Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2020-8277 PoC — Oracle GraalVM 资源管理错误漏洞

Source
Associated Vulnerability
Title:Oracle GraalVM 资源管理错误漏洞 (CVE-2020-8277)
Description:Oracle GraalVM是美国甲骨文(Oracle)公司的一套使用Java语言编写的即时编译器。该产品支持多种编程语言和执行模式。 Oracle GraalVM 的 Oracle GraalVM Enterprise Edition 存在资源管理错误漏洞,该漏洞源于网络系统或产品对系统资源(如内存、磁盘空间、文件等)的管理不当。
Readme
# CVE-2020-8277

For educational purposes only.

## Quick Run 
```
# clone this repository
$ git clone https://github.com/masahiro331/CVE-2020-8277

# run bind
$ docker build -t bind-local  ./bind
# Need TCP fallback
$ docker run --rm --name bind -it -p 53:53 -p 53:53/udp bind

# use "< v15.2.1" version
# If you use fixed version, build node.
$ git clone https://github.com/nodejs/node
$ git checkout df211208c0
$ ./configure
$ make -j8
$ make install

# Run PoC
$ node main.js
```

## Details

See Reference for the details.    
https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/  
The advisory states that resolving a hostname that returns a large number of records will result in DoS.   


The vulnerability has read out of memory error.  
Affected line.   
https://github.com/nodejs/node/blob/1fd2c8142b611baadc973947b83c0863cb003d9d/src/cares_wrap.cc#L764  
File Snapshot

[4.0K] /data/pocs/c1f10f0ec7f57f7926bab9e9727b183daea6f325 ├── [4.0K] bind │   ├── [1.6K] Dockerfile │   └── [4.0K] misc │   ├── [ 77K] masahiro331.com.zone │   ├── [ 37] named │   └── [1.9K] named.conf ├── [ 220] main.js └── [ 888] README.md 2 directories, 6 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.