The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than<\/p>\n
four bytes (nxd_tftp_server.c:1037) and nothing anywhere checks an upper bound, in particular not<\/p>\n
against the protocol maximum of 4 + NX_TFTP_FILE_TRANSFER_MAX. Two things follow from that one<\/p>\n
missing check, both reachable before any authentication because TFTP has none.<\/p>\n
The handler passes `nx_packet_length – 4` straight to FileX:<\/p>\n
“`c<\/p>\n
\/* addons\/tftp\/nxd_tftp_server.c:1863, 1889 *\/<\/p>\n
status = nx_packet_copy(packet_ptr, &temp_ptr,<\/p>\n
server_ptr -> nx_tftp_server_packet_pool_ptr, NX_WAIT_FOREVER);<\/p>\n
…<\/p>\n
fx_file_write(&(client_request_ptr -> nx_tftp_client_request_file),<\/p>\n
packet_ptr -> nx_packet_prepend_ptr + 4,
\n packet_ptr -> nx_packet_length – 4);<\/p>\n
“`<\/p>\n
`nx_packet_length` is the length of a chain, not of one contiguous buffer, so FileX copies past the<\/p>\n
end of the first packet:<\/p>\n
“`<\/p>\n
ERROR: AddressSanitizer: heap-buffer-overflow<\/p>\n
READ of size 1280 at 0x621000001108 thread T5<\/p>\n
#0 __interceptor_memcpy
\n #1 _fx_utility_memory_copy filex\/common\/src\/fx_utility_memory_copy.c:78<\/p>\n
0x621000001108 is 0 bytes to the right of 4104-byte region<\/p>\n
“`<\/p>\n
Those bytes are written into the file the attacker is uploading, and a TFTP read request hands them<\/p>\n
back, so this is a memory disclosure with a convenient retrieval channel.<\/p>\n
The same datagram also wedges the server. `nx_packet_copy` at :1863 needs<\/p>\n
ceil(nx_packet_length \/ pool_payload) packets and asks for them with NX_WAIT_FOREVER, so when the<\/p>\n
attacker sizes the datagram beyond what the pool holds, the server thread suspends and never<\/p>\n
returns. A liveness probe after one such datagram times out with the pool at 0 of 12 packets and<\/p>\n
the server thread suspended, and no later client is served.<\/p>\n
Reject `nx_packet_length > 4 + NX_TFTP_FILE_TRANSFER_MAX` in the DATA branch before either call,<\/p>\n
and use a bounded wait rather than NX_WAIT_FOREVER for the copy.<\/p>\n","protected":false},"excerpt":{"rendered":"
The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than<\/p>\n
four bytes (nxd_tftp_server.c:1037) and nothing anywhere checks an upper bound, in particular not<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-30697","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/30697","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=30697"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=30697"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=30697"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}