Double Free in TCPServer

[Halcy0nic]

Hi there!

I was running my fuzzer in the background when I discovered a double free in the SimpleNetwork TCPServer.

Impact

Triggering the double free will allow client to crash any SimpleNetwork TCP server remotely. In other situations, double free vulnerabilities can cause undefined behavior and potentially code execution in the right circumstances.

Reproduction

Create a file with a large amount of random characters

Start a TCP server and send the large file to the server a few consecutive times

View the crash and gdb backtrace

Extra Resources

• https://owasp.org/www-community/vulnerabilities/Doubly_freeing_memory
• https://cwe.mitre.org/data/definitions/415.html

[Halcy0nic]

Here is the valgrind output showing the invalid double free:

[Halcy0nic]

This issue was assigned CVE-2022-36234. Proof of concept Python3 code can be found here:

https://github.com/Halcy0nic/CVE-2022-36234