1468542 - BLRG-PT-18-004: Off-By-One Write in SECU_FilePasswd()

Status: RESOLVED FIXED

(Toolkit :: Application Update, defect, P1)

Description

[Julien Vehent]

In file sign/nss_secutil.c the function SECU_FilePasswd() iterated over the phrases array which was stored on the heap. The length of the array was stored in nb. In case the while loop existed because i == nb, the zero-termination which followed wrote past the end of the array.

This led to a memory corruption, which is likely hard to exploit, but off by one writes on the heap have been exploited in the past [1].

The affected component is only used locally and the password input data can be considered trusted to a certain degree. Therefore the impact is limited.

X41 D-Sec GmbH advises to check for i ==nb before terminating the phrases buffer.


[1] CVE-2018-6789-en/">https://devco.re/blog/2018/03/06/exim-off-by-one-RCE-exploiting-CVE-2018-6789-en/

Comment 1

[June Wilde (she/her) [:jewilde]]

Attachment: Bug 1468542 - Restrict acceptable bounds for i in nss_secutil; r?rstrong

Adds some missing braces on if structures
Adds a check for i being larger or equal to nb

Comment 2

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/integration/autoland/rev/97613730a99f6156f256d351b5b7767b1d80a2b6

Comment 3

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/97613730a99f