1632241 - (CVE-2020-6831) Buffer overflow in sctp chunk input validation

Status: RESOLVED FIXED

(Core :: WebRTC: Networking, defect)

Description

[Nils Ohlmeier [:drno]]

Upstream usrsctp has been notified about a buffer overflow in their implementation.

The patch for it is available upstream here https://github.com/sctplab/usrsctp/commit/e1dd9bea4f438abf4d4c3b658f1db8f013157184

Alternatively we could work around the problematic code path by disabling SCTP authentication with the following (as that feature isn't used in webrtc any way):
usrsctp_sysctl_set_sctp_asconf_enable(0);
usrsctp_sysctl_set_sctp_auth_enable(0);

Comment 1

[Nils Ohlmeier [:drno]]

Attachment: Bug 1632241: add SCTP auth token boundary check

Comment 2

[Nils Ohlmeier [:drno]]

Attachment: Bug 1632241: turn off SCTP auth and address reconfiguration

Depends on D72053

Comment 3

[Daniel Veditz [:dveditz]]

Public commit doesn't literally say "SECURITY BUG!" but it does thank a prominent member of Google Project Zero. We should get a fix into 76 and ESR. Nils suggests using the the "turn it off" patch for uplift. I wouldn't mind taking both!

Comment 4

[Ryan VanderMeulen [:RyanVM]]

We're building RCs on Monday, so patches will need to be reviewed and land ASAP to make it into 76/68.8.

Comment 5

[Nils Ohlmeier [:drno]]

Comment on attachment 9142549 [details]
Bug 1632241: add SCTP auth token boundary check

Security Approval Request

• How easily could an exploit be constructed based on the patch?: Not very hard with knowledge on how WebRTC data channel works.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which older supported branches are affected by this flaw?: all
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?:
• How likely is this patch to cause regressions; how much testing does it need?: Not very likely as the affected code paths normally should not be triggered by normal WebRTC endpoints.

Comment 6

[Daniel Veditz [:dveditz]]

Comment on attachment 9142549 [details]
Bug 1632241: add SCTP auth token boundary check

sec-approval+ and a=dveditz for beta uplift.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/autoland/rev/b277e280752ea2fa583cb901ee8b4c175d1313bd
https://hg.mozilla.org/integration/autoland/rev/685b6848524821b77d8d4aa0e11f9c2d35a76a1e

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Fixed in 76.0b8.

https://hg.mozilla.org/releases/mozilla-beta/rev/35616be71c33
https://hg.mozilla.org/releases/mozilla-beta/rev/e3b02434661a

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/b277e280752e
https://hg.mozilla.org/mozilla-central/rev/685b68485248

Comment 10

[Nils Ohlmeier [:drno]]

Comment on attachment 9142549 [details]
Bug 1632241: add SCTP auth token boundary check

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: It is sec-high
• User impact if declined: Users would be exposed to the technically possible drive-by buffer overflow.
• Fix Landed on Version: 76
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The risk is low, because the buffer overflow is on a code path which is normally not used in WebRTC. That means only a specifically crafted PeerConnection endpoints which sends packets which are normally not send as part of WebRTC connection could trigger this.
• String or UUID changes made by this patch: N/A

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9142549 [details]
Bug 1632241: add SCTP auth token boundary check

Approved for 68.8esr.

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr68/rev/b43b8e87ef03
https://hg.mozilla.org/releases/mozilla-esr68/rev/3eafea41965b

Comment 13

[Frederik Braun [:freddy]]

Attachment: advisory.txt

Comment 14

[Daniel Veditz [:dveditz]]

Looks like Chrome is going to ship this fix in an update to their current Stable 81 soon and not wait for 83 (there was no 82)

Comment 15

[Daniel Veditz [:dveditz]]

Chatted with adetaylor on the Chrome security team and we'll assign CVE-2020-6831 to this SCTP bug.