In Toxcore, the reference implementation of the P2P messaging protocol Tox, a vulnerability (CVE-2021-44847) has been identified that potentially allows remote code execution when processing a specially crafted UDP packet. All users of applications based on Toxcore that have not disabled UDP transport are vulnerable. An attack can be initiated by sending a UDP packet if the IP address, network port, and open DHT key of the victim are known (this information is publicly available in DHT, meaning the attack could be carried out against any user or DHT node).
The issue was present in Toxcore releases from 0.1.9 to 0.2.12 and was fixed in version 0.2.13. So far, only the qTox project has released updates addressing the vulnerability among client applications. As a workaround for protection, UDP can be disabled while retaining support for TCP.
The vulnerability is caused by a buffer overflow in the handle_request() function, arising from incorrect calculations of the data size in the network packet. Specifically, the length of the encrypted data was determined in the CRYPTO_SIZE macro, defined as '1 + CRYPTO_PUBLIC_KEY_SIZE * 2 + CRYPTO_NONCE_SIZE', which was later used in the subtraction operation 'length - CRYPTO_SIZE'. Due to a lack of parentheses in the macro, instead of subtracting the sum of all values, it performed a subtraction of 1 and added the other components. For example, instead of 'length - (1 + 32 * 2 + 24)', the buffer size was calculated as 'length - 1 + 32 * 2 + 24', leading to data overwriting in the stack beyond the buffer boundaries.
Kilde: opennet.ru
