Mon Jun 1 09:19:29 EEST 2020

Exploitability of the integer overflows in djbdns 1.05?


Exploitability of the integer overflows in djbdns 1.05?

TLDR: Are the integer overflows in djbdns 1.05 exploitable?

Background: there are integer overflows and memory corruption
in the library functions of qmail 1.03.
For reference see [1] [2].

Some of the qmail vulnerabilities (integer overflows and negative index???)
are present in djbdns 1.05.

For example in alloc.c of djbdns:
====
/*@null@*//*@out@*/char *alloc(n)
unsigned int n;
{
  char *x;
  n = ALIGNMENT + n - (n & (ALIGNMENT - 1)); /* XXX: could overflow */
=====

This clearly overflows for n= -1 for example.

It is natural to write an integer overflow, but
documenting easy to fix security bug is beyond
our understanding.

Reachability of the bugs is not clear and might require
gigabytes of memory to hit the problems by encoding
integer in unary.

In addition djbns limits the memory usage by |softlimit|,
but we are not sure the limits are on all vulnerable
programs. An island of tractability could be |alloc(atoi())|
or |alloc(size * count)|

Is djbdns exploitable by any of the qmail bugs?

[1] http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html
[2] https://www.openwall.com/lists/oss-security/2020/05/19/8

Posted by joro | Permanent link