In Toxcore, the reference implementation of the P2P messaging protocol Tox, a vulnerability (CVE-2021-44847) has been identified that potentially allows for code execution upon processing specially crafted UDP packets. All users of applications based on Toxcore, where UDP transport is not disabled, are susceptible to this vulnerability. An attack is sufficient by sending a UDP packet while knowing the victim's IP address, network port, and the open DHT key (this information is publicly available in DHT, meaning the attack could be executed on any user or DHT node).
The issue was present in Toxcore releases from 0.1.9 to 0.2.12 and has been resolved in version 0.2.13. So far, only the qTox project has released an update to fix the vulnerability among client applications. As a workaround for protection, UDP usage can be disabled while retaining TCP support.
The vulnerability is caused by a buffer overflow in the handle_request() function, which occurs due to an incorrect calculation of the data size in the network packet. In particular, the length of the encrypted data was defined in the CRYPTO_SIZE macro, specified as "1 + CRYPTO_PUBLIC_KEY_SIZE * 2 + CRYPTO_NONCE_SIZE", which was subsequently used in the subtraction operation "length — CRYPTO_SIZE". Due to the absence of parentheses in the macro, instead of subtracting the sum of all values, it performed subtraction of 1 and addition of the other parts. For example, instead of "length — (1 + 32 * 2 + 24)", the buffer size was calculated as "length — 1 + 32 * 2 + 24", which resulted in data being overwritten in the stack, going beyond the buffer limits.
Bron: opennet.ru
