{"id":102629,"date":"2021-12-16T03:36:46","date_gmt":"2021-12-16T01:36:46","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/perepolnenie-bufera-v-toxcore-ekspluatiruemoe-cherez-otpravku-udp-paketa"},"modified":"2021-12-16T03:36:46","modified_gmt":"2021-12-16T01:36:46","slug":"perepolnenie-bufera-v-toxcore-ekspluatiruemoe-cherez-otpravku-udp-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/perepolnenie-bufera-v-toxcore-ekspluatiruemoe-cherez-otpravku-udp-paketa","title":{"rendered":"Buffer overflow in Toxcore, exploited through sending a UDP packet","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability (CVE-2021-44847) has been identified in Toxcore, the reference implementation of the P2P messaging protocol Tox, which potentially allows for code execution during the handling of a specially crafted UDP packet. All users of applications based on Toxcore that do not have UDP transport disabled are affected by this vulnerability. To exploit it, one only needs to send a UDP packet knowing the victim's IP address, network port, and open DHT key (this information is publicly available in DHT, meaning the attack could be carried out on any user or DHT node). <\/p>\n
The issue manifested in toxcore releases from 0.1.9 to 0.2.12 and has been fixed in version 0.2.13. So far, only the qTox project has released an update addressing the vulnerability among client applications. As a temporary protective measure, UDP usage can be disabled while keeping TCP support. <\/p>\n
The vulnerability is caused by a buffer overflow in the handle_request() function, which arises from incorrect calculation of the data size in the network packet. Specifically, the length of the encrypted data was defined in the CRYPTO_SIZE macro, which was set as \"1 + CRYPTO_PUBLIC_KEY_SIZE * 2 + CRYPTO_NONCE_SIZE\". This was subsequently used in the subtraction operation \"length - CRYPTO_SIZE\". Due to the absence of parentheses in the macro, instead of subtracting the total sum of all values, it performed the subtraction of 1 and added the remaining parts. For example, instead of \"length - (1 + 32 * 2 + 24)\", the buffer size was calculated as \"length - 1 + 32 * 2 + 24\", which led to overwriting data in the stack that was outside the buffer. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"