Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Double Free in TCPServer #22

Closed
Halcy0nic opened this issue Jul 14, 2022 · 2 comments
Closed

Double Free in TCPServer #22

Halcy0nic opened this issue Jul 14, 2022 · 2 comments

Comments

@Halcy0nic
Copy link

Hi there!

I was running my fuzzer in the background when I discovered a double free in the SimpleNetwork TCPServer.

Impact

Triggering the double free will allow client to crash any SimpleNetwork TCP server remotely. In other situations, double free vulnerabilities can cause undefined behavior and potentially code execution in the right circumstances.

Reproduction

Create a file with a large amount of random characters

Screen Shot 2022-07-14 at 4 27 10 PM

Start a TCP server and send the large file to the server a few consecutive times

Screen Shot 2022-07-14 at 5 06 48 PM

View the crash and gdb backtrace

Screen Shot 2022-07-14 at 4 30 14 PM

Screen Shot 2022-07-14 at 5 06 14 PM

Extra Resources

@Halcy0nic
Copy link
Author

Here is the valgrind output showing the invalid double free:
Screen Shot 2022-07-22 at 4 45 45 PM

@Halcy0nic
Copy link
Author

Halcy0nic commented Jan 31, 2023

This issue was assigned CVE-2022-36234. Proof of concept Python3 code can be found here:

https://github.com/Halcy0nic/CVE-2022-36234

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant