A vulnerability (CVE-2021-44847) has been identified in Toxcore, the reference implementation of the P2P messaging protocol Tox, which potentially allows for code execution during the handling of a specially crafted UDP packet. All users of applications based on Toxcore that do not have UDP transport disabled are affected by this vulnerability. To exploit it, one only needs to send a UDP packet knowing the victim's IP address, network port, and open DHT key (this information is publicly available in DHT, meaning the attack could be carried out on any user or DHT node).
The issue manifested in toxcore releases from 0.1.9 to 0.2.12 and has been fixed in version 0.2.13. So far, only the qTox project has released an update addressing the vulnerability among client applications. As a temporary protective measure, UDP usage can be disabled while keeping TCP support.
The vulnerability is caused by a buffer overflow in the handle_request() function, arising from incorrect size calculation of data in the network packet. Specifically, the length of the encrypted data was determined in the CRYPTO_SIZE macro, defined as "1 + CRYPTO_PUBLIC_KEY_SIZE * 2 + CRYPTO_NONCE_SIZE", which was subsequently used in the subtraction operation "length — CRYPTO_SIZE". Due to the lack of parentheses in the macro, instead of subtracting the sum of all values, 1 was subtracted, and the remaining parts were added. For example, instead of "length — (1 + 32 * 2 + 24)", the buffer size was calculated as "length — 1 + 32 * 2 + 24", leading to data overwriting in the stack that was outside the buffer.
Source: opennet.ru
