<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Heap-buffer-overflow in iptables-restore and ip6tables-restore"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1741">1741</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Heap-buffer-overflow in iptables-restore and ip6tables-restore
</td>
</tr>
<tr>
<th>Product</th>
<td>iptables
</td>
</tr>
<tr>
<th>Version</th>
<td>1.8.x
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>Ubuntu
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>major
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>iptables-restore
</td>
</tr>
<tr>
<th>Assignee</th>
<td>netfilter-buglog@lists.netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>gorbanev.es@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=738" name="attach_738" title="Patch">attachment 738</a> <a href="attachment.cgi?id=738&action=edit" title="Patch">[details]</a></span>
Patch
When running fuzzing tests with AddressSanitizer I found 2 bugs for
iptables-restore and ip6tables-restore.
I also attach a patch to fix the bugs for v1.8.10.
Logs:
[root@ubuntu sbin]# ./iptables-restore
*filter
-c ""
=================================================================
==19922==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x602000000091 at pc 0x7f8f5e83dd68 bp 0x7ffc57c3e1c0 sp 0x7ffc57c3d968
READ of size 1 at 0x602000000091 thread T0
#0 0x7f8f5e83dd67 (/usr/lib64/libasan.so.6+0x3dd67)
#1 0x555e8d206111 in do_parse
/home/user/test/iptables/iptables/xshared.c:1888
#2 0x555e8d210a46 in do_command4
/home/user/test/iptables/iptables/iptables.c:694
#3 0x555e8d20b474 in ip46tables_restore_main
/home/user/test/iptables/iptables/iptables-restore.c:334
#4 0x555e8d20b936 in iptables_restore_main
/home/user/test/iptables/iptables/iptables-restore.c:384
#5 0x555e8d1f9ef9 in subcmd_main
/home/user/test/iptables/iptables/xshared.c:219
#6 0x555e8d2092d1 in main
/home/user/test/iptables/iptables/xtables-legacy-multi.c:49
#7 0x7f8f5e64eefc in __libc_start_main (/lib64/libc.so.6+0x27efc)
#8 0x555e8d1f4a79 in _start
(/home/user/test/iptables/buildroot/sbin/xtables-legacy-multi+0xfa79)
0x602000000091 is located 0 bytes to the right of 1-byte region
[0x602000000090,0x602000000091)
allocated by thread T0 here:
#0 0x7f8f5e859707 in strdup (/usr/lib64/libasan.so.6+0x59707)
#1 0x7f8f5f23aca6 in xtables_strdup
/home/user/test/iptables/libxtables/xtables.c:466
#2 0x555e8d1fb571 in add_argv
/home/user/test/iptables/iptables/xshared.c:434
#3 0x555e8d1fbfef in add_param_to_argv
/home/user/test/iptables/iptables/xshared.c:529
#4 0x555e8d20b3db in ip46tables_restore_main
/home/user/test/iptables/iptables/iptables-restore.c:328
#5 0x555e8d20b936 in iptables_restore_main
/home/user/test/iptables/iptables/iptables-restore.c:384
#6 0x555e8d1f9ef9 in subcmd_main
/home/user/test/iptables/iptables/xshared.c:219
#7 0x555e8d2092d1 in main
/home/user/test/iptables/iptables/xtables-legacy-multi.c:49
#8 0x7f8f5e64eefc in __libc_start_main (/lib64/libc.so.6+0x27efc)
SUMMARY: AddressSanitizer: heap-buffer-overflow
(/usr/lib64/libasan.so.6+0x3dd67)
Shadow bytes around the buggy address:
0x0c047fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff8000: fa fa 00 fa fa fa 03 fa fa fa 07 fa fa fa 03 fa
=>0x0c047fff8010: fa fa[01]fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==19922==ABORTING
[root@ubuntu sbin]# ./ip6tables-restore
*filter
-c ""
=================================================================
==19987==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x602000000091 at pc 0x7f4df283dd68 bp 0x7ffdd6630f00 sp 0x7ffdd66306a8
READ of size 1 at 0x602000000091 thread T0
#0 0x7f4df283dd67 (/usr/lib64/libasan.so.6+0x3dd67)
#1 0x55cdcf10f111 in do_parse
/home/user/test/iptables/iptables/xshared.c:1888
#2 0x55cdcf11f85c in do_command6
/home/user/test/iptables/iptables/ip6tables.c:701
#3 0x55cdcf114474 in ip46tables_restore_main
/home/user/test/iptables/iptables/iptables-restore.c:334
#4 0x55cdcf114a66 in ip6tables_restore_main
/home/user/test/iptables/iptables/iptables-restore.c:416
#5 0x55cdcf102ef9 in subcmd_main
/home/user/test/iptables/iptables/xshared.c:219
#6 0x55cdcf1122d1 in main
/home/user/test/iptables/iptables/xtables-legacy-multi.c:49
#7 0x7f4df264eefc in __libc_start_main (/lib64/libc.so.6+0x27efc)
#8 0x55cdcf0fda79 in _start
(/home/user/test/iptables/buildroot/sbin/xtables-legacy-multi+0xfa79)
0x602000000091 is located 0 bytes to the right of 1-byte region
[0x602000000090,0x602000000091)
allocated by thread T0 here:
#0 0x7f4df2859707 in strdup (/usr/lib64/libasan.so.6+0x59707)
#1 0x7f4df32fdca6 in xtables_strdup
/home/user/test/iptables/libxtables/xtables.c:466
#2 0x55cdcf104571 in add_argv
/home/user/test/iptables/iptables/xshared.c:434
#3 0x55cdcf104fef in add_param_to_argv
/home/user/test/iptables/iptables/xshared.c:529
#4 0x55cdcf1143db in ip46tables_restore_main
/home/user/test/iptables/iptables/iptables-restore.c:328
#5 0x55cdcf114a66 in ip6tables_restore_main
/home/user/test/iptables/iptables/iptables-restore.c:416
#6 0x55cdcf102ef9 in subcmd_main
/home/user/test/iptables/iptables/xshared.c:219
#7 0x55cdcf1122d1 in main
/home/user/test/iptables/iptables/xtables-legacy-multi.c:49
#8 0x7f4df264eefc in __libc_start_main (/lib64/libc.so.6+0x27efc)
SUMMARY: AddressSanitizer: heap-buffer-overflow
(/usr/lib64/libasan.so.6+0x3dd67)
Shadow bytes around the buggy address:
0x0c047fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff8000: fa fa 01 fa fa fa 03 fa fa fa 07 fa fa fa 03 fa
=>0x0c047fff8010: fa fa[01]fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==19987==ABORTING</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>