CVE-2023-43632
Freely Allocate Buffer on The Stack With Data From Socket
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
As noted in the “VTPM.md” file in the eve documentation, “VTPM is a server listening on port
8877 in EVE, exposing limited functionality of the TPM to the clients.
VTPM allows clients to
execute tpm2-tools binaries from a list of hardcoded options”
The communication with this server is done using protobuf, and the data is comprised of 2
parts:
1. Header
2. Data
When a connection is made, the server is waiting for 4 bytes of data, which will be the header,
and these 4 bytes would be parsed as uint32 size of the actual data to come.
Then, in the function “handleRequest” this size is then used in order to allocate a payload on
the stack for the incoming data.
As this payload is allocated on the stack, this will allow overflowing the stack size allocated for
the relevant process with freely controlled data.
* An attacker can crash the system.
* An attacker can gain control over the system, specifically on the “vtpm_server” process
which has very high privileges.
Como se indica en el archivo “VTPM.md” en la documentación de eve, “VTPM es un servidor que escucha en el puerto 8877 en EVE, lo que expone la funcionalidad limitada del TPM a los clientes. VTPM permite a los clientes ejecutar binarios de tpm2-tools a partir de una lista de opciones codificadas. La comunicación con este servidor se realiza mediante protobuf y los datos se componen de 2 partes: 1. Encabezado 2. Datos Cuando se realiza una conexión, el servidor esperando 4 bytes de datos, que serán el encabezado, y estos 4 bytes se analizarán como el tamaño uint32 de los datos reales siguientes. Luego, en la función ""handleRequest"", este tamaño se usa para asignar un payload en memoria para los datos entrantes. A medida que este payload se asigna en la memoria, esto permitirá desbordar el tamaño asignado para el proceso relevante con datos libremente controlados.
* Un atacante puede bloquear el sistema.
* Un atacante puede obtener control sobre el sistema, específicamente sobre el proceso ""vtpm_server"", que tiene privilegios muy altos.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2023-09-20 CVE Reserved
- 2023-09-21 CVE Published
- 2024-09-24 CVE Updated
- 2024-09-27 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-770: Allocation of Resources Without Limits or Throttling
- CWE-789: Memory Allocation with Excessive Size Value
CAPEC
- CAPEC-100: Overflow Buffers
References (1)
URL | Tag | Source |
---|---|---|
https://asrg.io/security-advisories/cve-2023-43632 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Linuxfoundation Search vendor "Linuxfoundation" | Edge Virtualization Engine Search vendor "Linuxfoundation" for product "Edge Virtualization Engine" | >= 3.0.0 < 9.5.0 Search vendor "Linuxfoundation" for product "Edge Virtualization Engine" and version " >= 3.0.0 < 9.5.0" | - |
Affected
|