A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the<\/p>\n
received datagram.<\/p>\n
Each receive path checks only that the datagram is at least four bytes long (nxd_tftp_client.c:1229,<\/p>\n
1521, 1984). When the opcode is NX_TFTP_CODE_ERROR the message string is copied with a loop whose<\/p>\n
only limits are the destination buffer and a NUL byte:<\/p>\n
“`c<\/p>\n
\/* addons\/tftp\/nxd_tftp_client.c:1769 *\/<\/p>\n
for (i = 0; (i nx_tftp_client_error_string) – 1)) && (*buffer_ptr); i++)<\/p>\n
“`<\/p>\n
Nothing compares `buffer_ptr` against `nx_packet_append_ptr`. An ERROR packet that carries no<\/p>\n
terminating NUL, which a server controls completely, walks the loop off the end of the packet until<\/p>\n
it happens to meet a zero byte or fills the 64 byte destination.<\/p>\n
“`<\/p>\n
ERROR: AddressSanitizer: heap-buffer-overflow<\/p>\n
READ of size 1 at 0x60d0000000c8 thread T4<\/p>\n
#0 _nxd_tftp_client_file_read addons\/tftp\/nxd_tftp_client.c:1769<\/p>\n
0x60d0000000c8 is 0 bytes to the right of 136-byte region<\/p>\n
“`<\/p>\n
The open path has the same loop at :1327 and reports the same way. What is read lands in<\/p>\n
`nx_tftp_client_error_string`, which the application is expected to display or log, so adjacent<\/p>\n
packet pool memory ends up in whatever the device does with the error text.<\/p>\n
Add `(buffer_ptr nx_packet_append_ptr)` to the loop condition in all three paths.<\/p>\n","protected":false},"excerpt":{"rendered":"
A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the<\/p>\n
received datagram.<\/p>\n
Each receive path checks only that the datagram is at least four bytes long <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-30704","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/30704","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=30704"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=30704"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=30704"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}