oss-security - Re: CVE request: PulseAudio crash due to empty UDP packet

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 04 Jun 2014 21:48:14 +0600
From: "Alexander E. Patrakov" <patrakov@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: PulseAudio crash due to empty UDP packet

04.06.2014 21:30, cve-assign@...re.org wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>> If one has module-rtp-recv loaded into PulseAudio, then a remote
>> attacker can crash this instance of PulseAudio by sending an empty UDP
>> packet
>
>> memblock.c: Assertion 'b' failed
>
> Use CVE-2014-3970.

Thanks!

>> PulseAudio usually gets respawned anyway.
>
> Apparently there are realistic circumstances in which respawning
> doesn't happen (possibly a zero value of conf->daemonize or the
> "User-configured server at %s, refusing to start/autospawn." case in
> http://cgit.freedesktop.org/pulseaudio/pulseaudio/tree/src/daemon/main.c).

Yes, there is a parameter in the daemon.conf configuration file that 
allows the user to turn the autospawn off.

>> http://lists.freedesktop.org/archives/pulseaudio-discuss/2014-May/020740.html
>
>> expecting to find an infinite loop (as it would be common for such
>> FIONREAD misuse), but found an assertion failure instead. So there may
>> be two bugs.
>
> The scope of CVE-2014-3970 does not include any infinite loop that
> might be discovered later.

I have tested the patch, and it survives the empty packet without the 
infinite loop. Besides, after the patch, there is no code path in which 
recvmsg() is not called after a successful FIONREAD ioctl (even if it 
returns a zero size). So, any FIONREAD-related infinite loop that 
possibly remains on the RTP reception path after the patch is to be 
found on the path where the ioctl itself fails.

-- 
Alexander E. Patrakov

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.