mbedtls_net_poll corrupts the stack if socket number >= 1024 #4169
Assignees
Labels
Comments
|
ASAN report: |
yanesca
added
bug
Community
component-platform
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Feb 24, 2021
mbedtls_net_poll() and mbedtls_net_recv_timeout() rely on select(), which represents sets of file descriptors through the fd_set type. This type cannot hold file descriptors larger than FD_SETSIZE. Make sure that these functions identify this failure code. Without a proper range check of the file descriptor in the mbedtls_net_xxx function, this test fails when running with UBSan: ``` net_poll beyond FD_SETSIZE ........................................ source/library/net_sockets.c:482:9: runtime error: index 16 out of bounds for type '__fd_mask [16]' SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior source/library/net_sockets.c:482:9 in ``` This is a non-regression test for Mbed-TLS#4169 . The implementation of this test is specific to Unix-like platforms. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Feb 24, 2021
Fix a stack buffer overflow with mbedtls_net_poll() and mbedtls_net_recv_timeout() when given a file descriptor that is beyond FD_SETSIZE. The bug was due to not checking that the file descriptor is within the range of an fd_set object. Fix Mbed-TLS#4169 Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
|
Hi @FigBug and thanks for your report! We agree with your assessment and have created a PR with a fix and non-regression test: #4173, so the issue will be fixed in the next release. As all memory management bugs, this potentially has security implications. In the future, I would like to encourage you (and any other contributor reading this) to report security vulnerabilities privately to mbed-tls-security@lists.trustedfirmware.org rather than using a github issue, so that we can handle it according to our security process - basically this ensures that a fix is available and ready to be deployed before the issue gets public. |
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Feb 25, 2021
mbedtls_net_poll() and mbedtls_net_recv_timeout() rely on select(), which represents sets of file descriptors through the fd_set type. This type cannot hold file descriptors larger than FD_SETSIZE. Make sure that these functions identify this failure code. Without a proper range check of the file descriptor in the mbedtls_net_xxx function, this test fails when running with UBSan: ``` net_poll beyond FD_SETSIZE ........................................ source/library/net_sockets.c:482:9: runtime error: index 16 out of bounds for type '__fd_mask [16]' SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior source/library/net_sockets.c:482:9 in ``` This is a non-regression test for Mbed-TLS#4169 . The implementation of this test is specific to Unix-like platforms. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Feb 25, 2021
Fix a stack buffer overflow with mbedtls_net_poll() and mbedtls_net_recv_timeout() when given a file descriptor that is beyond FD_SETSIZE. The bug was due to not checking that the file descriptor is within the range of an fd_set object. Fix Mbed-TLS#4169 Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Mar 1, 2021
Fix a stack buffer overflow with mbedtls_net_poll() and mbedtls_net_recv_timeout() when given a file descriptor that is beyond FD_SETSIZE. The bug was due to not checking that the file descriptor is within the range of an fd_set object. Fix Mbed-TLS#4169 Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Mar 1, 2021
Fix a stack buffer overflow with mbedtls_net_recv_timeout() when given a file descriptor that is beyond FD_SETSIZE. The bug was due to not checking that the file descriptor is within the range of an fd_set object. Fix Mbed-TLS#4169 Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Mar 3, 2021
Fix a stack buffer overflow with mbedtls_net_recv_timeout() when given a file descriptor that is beyond FD_SETSIZE. The bug was due to not checking that the file descriptor is within the range of an fd_set object. Fix Mbed-TLS#4169 Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
Bug
OS
macOS
mbed TLS build:
Version: a0fd0f8
OS version: 11.1
Expected behavior
Not corrupt the stack
Actual behavior
The stack is corrupted
Steps to reproduce
Open 1024 sockets. Doesn't matter if they are mbedtls sockets or not. Then open another socket via mbedtls and call mbedtls_net_poll
Enhancement\Feature Request
Justification - why does the library need this feature?
mbedtls should not crash the application if more than 1024 sockets are open
Suggested enhancement
Man page for fd_set says "An fd_set is a fixed size buffer. Executing FD_CLR() or FD_SET() with a value of fd that is negative or is equal to or larger than FD_SETSIZE will result in undefined behavior. Moreover, POSIX requires fd to be a valid file descriptor." mbedtls_net_poll should check that the socket number is >= 0 and < FD_SETSIZE.
The text was updated successfully, but these errors were encountered: