Toxcore, iyo referensi yekumisikidzwa kweTox P2P messaging protocol, ine njodzi (CVE-2021-44847) iyo inogona kukonzeresa kuurayiwa kwekodhi kana uchigadzira yakanyatso gadzirwa UDP pakiti. Vese vashandisi veToxcore-based application vasina kutakura UDP vakaremara vanokanganiswa nekusagadzikana. Kuti urwise, zvakakwana kutumira UDP packet uchiziva IP kero, network port uye yeruzhinji DHT kiyi yemunhu akabatwa (ruzivo urwu rwunowanikwa pachena muDHT, i.e. kurwiswa kunogona kuitwa kune chero mushandisi kana DHT node).
Nyaya yaivepo mutoxcore yakabudiswa 0.1.9 kuburikidza ne0.2.12 uye yakagadziriswa mushanduro 0.2.13. Pakati pemashandisirwo emutengi, chete qTox purojekiti kusvika parizvino yakaburitsa imwe update inobvisa kusagadzikana. Sekuchengetedza workaround, unogona kudzima UDP uchichengeta TCP rutsigiro.
Kusagadzikana kunokonzerwa nekufashukira kwebuffer mu handle_request() basa, rinoitika nekuda kwekuverenga kusiri iko kwesaizi yedata munetwork packet. Kunyanya, kureba kwedata rakavharidzirwa kwakatemwa mune macro CRYPTO_SIZE, inotsanangurwa se "1 + CRYPTO_PUBLIC_KEY_SIZE * 2 + CRYPTO_NONCE_SIZE", iyo yakazoshandiswa mukubvisa "kureba - CRYPTO_SIZE". Nekuda kwekushaikwa kwevabereki mu macro, pachinzvimbo chekubvisa huwandu hwese kukosha, yakabvisa 1 uye yakawedzera zvikamu zvasara. Semuenzaniso, pachinzvimbo che "kureba - (1 + 32 * 2 + 24)", saizi yebhafa yakaverengerwa se "kureba - 1 + 32 * 2 + 24", izvo zvakakonzera kupenengura data pane stack kupfuura muganhu webuffer.
Source: opennet.ru