Any host on the LAN can send two mDNS records and make the responder write past the end of its<\/p>\n
transmit packet.<\/p>\n
The string table stores each name in a slot rounded up to a multiple of four:<\/p>\n
“`c<\/p>\n
\/* addons\/mdns\/nxd_mdns.c:11436, 11443, 11447 *\/<\/p>\n
memory_len = ((memory_len & 0xFFFFFFFC) + 8) & 0xFFFFFFFF;<\/p>\n
…<\/p>\n
len = *((USHORT*)(p – 2)); \/* slot size, not string length *\/<\/p>\n
if ((len == memory_len) && … _nx_mdns_name_match(start, memory_ptr, memory_size) …)<\/p>\n
“`<\/p>\n
The lookup that decides whether an incoming name is already stored compares the rounded slot size,<\/p>\n
so names of 12, 13, 14 and 15 characters share one bucket. A second name in the bucket is answered<\/p>\n
with the pointer to the first, and the record then carries a string up to three bytes longer than<\/p>\n
the length the caller accounted for. `_nx_mdns_packet_rr_add` (nxd_mdns.c:8911) sizes its only<\/p>\n
bound check from that stale length, and `_nx_mdns_name_string_encode` writes the real string.<\/p>\n
Two PTR records are enough, both ordinary mDNS responses to a `_http._tcp` query, with owner names<\/p>\n
whose lengths fall in the same bucket:<\/p>\n
“`<\/p>\n
==87491==ERROR: AddressSanitizer: heap-buffer-overflow<\/p>\n
WRITE of size 1 at 0x611000000124 thread T5<\/p>\n
#0 _nx_mdns_name_string_encode addons\/mdns\/nxd_mdns.c:13096
\n #1 _nx_mdns_packet_rr_add addons\/mdns\/nxd_mdns.c:8911<\/p>\n
0x611000000124 is 0 bytes to the right of 228-byte region<\/p>\n
“`<\/p>\n
The overflow is one to three bytes of attacker-influenced name data past `nx_packet_data_end`. In a<\/p>\n
normal pool that lands in the next packet in the same pool rather than in a redzone, so the visible<\/p>\n
effect is a corrupted neighbouring packet or a corrupted pool free list rather than a clean crash.<\/p>\n
Compare the slot size against the stored string length before declaring a match, or keep the<\/p>\n
string length in the slot header and return it to the caller so the encoder and the bound check<\/p>\n
agree.<\/p>\n","protected":false},"excerpt":{"rendered":"
Any host on the LAN can send two mDNS records and make the responder write past the end of its<\/p>\n
transmit packet.<\/p>\n
The string table stores each name in a slot rounded up to a multiple of four:<\/p>\n
`<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-30699","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/30699","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=30699"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=30699"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=30699"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}