{"id":104866,"date":"2022-08-17T09:36:49","date_gmt":"2022-08-17T07:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa"},"modified":"2022-08-17T09:36:49","modified_gmt":"2022-08-17T07:36:49","slug":"uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa","title":{"rendered":"A vulnerability in devices based on Realtek SoC, allowing code execution through the sending of a UDP packet.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers from Faraday Security presented details at the DEFCON conference regarding the exploitation of a critical vulnerability (CVE-2022-27255) in the SDK for Realtek RTL819x chips. This vulnerability allows arbitrary code execution on devices by sending a specially crafted UDP packet. Notably, it can target devices with web interface access disabled for external networks \u2014 a simple UDP packet is sufficient for the attack. <\/p>\n
The vulnerability affects devices using vulnerable versions of the Realtek SDK, including eCos RSDK 1.5.7p1 and MSDK 4.9.4p1. Updates to the eCos SDK that address the vulnerability were released by Realtek on March 25. It is still unclear which exact devices are affected \u2014 the Realtek RTL819x SoC is utilized in network routers, access points, Wi-Fi extenders, IP cameras, Internet of Things devices, and various other networking equipment from over 60 manufacturers, including Asus, A-Link, Beeline, Belkin, Buffalo, D-Link, Edison, Huawei, LG, Logitec, MT-Link, Netgear, Smartlink, UPVEL, ZTE, and Zyxel. <\/p>\n
Examples of exploits for gaining remote access to the device and executing commands have already been published in the public domain, including an attack example on the Nexxt Nebula 300 Plus router. Additionally, utilities for analyzing firmware for vulnerabilities have been made available. <\/p>\n
Considering the issues with preparation and delivery, as well as firmware updates for already released devices, automated attacks and worms targeting vulnerable network devices are expected to emerge soon. Following a successful attack, affected devices may be used by attackers to form botnets, insert backdoors to leave a loophole within the enterprise's internal network, intercept transit traffic, or redirect it to an external host. <\/p>\n
The vulnerability is caused by a buffer overflow in the 'SIP ALG' (SIP Application Layer Gateway) module, which is used for SIP packet forwarding behind a NAT. The issue arose due to the lack of validation for the actual size of the received data, leading to memory being overwritten beyond the fixed buffer when the strcpy function is called while processing SIP packets. An attack can be performed by sending a UDP packet with incorrect field values in the SDP data block or SIP protocol header. Exploitation requires sending just one packet to an arbitrary UDP port on the WAN interface.