Hi GNU Inetutils / Savannah Security Team,
I would like to report a security vulnerability in GNU Inetutils telnetd.
__Summary__
telnetd has a pre-authentication out-of-bounds write in net_output_data()
(telnetd/utility.c). An unauthenticated attacker can trigger it during
Telnet option negotiation by keeping the server's output backpressured and
driving nfrontp to netobuf + BUFSIZ. The size_t value "remaining" becomes
zero, "remaining - 1" underflows, and nfrontp is advanced past netobuf; a
later call writes beyond the buffer. This can crash telnetd and corrupt
adjacent BSS.
Affected Component
telnetd/utility.c: net_output_data() and the related net_output_datalen()
Versions: GNU Inetutils 2.4 through 2.8, including current development
HEAD (6907167). The code dates back to the 2002 rewrite, so older versions
may also be affected.
__Root Cause__
size_t remaining = BUFSIZ - (nfrontp - netobuf);
...
ret = vsnprintf(nfrontp, remaining, format, args);
nfrontp += ((ret < remaining - 1) ? ret : remaining - 1);
When nfrontp == netobuf + BUFSIZ, remaining is zero. Because remaining is
size_t, "remaining - 1" underflows to SIZE_MAX. vsnprintf() writes nothing
and returns the required length; nfrontp is then advanced past netobuf.
The next call computes a huge remaining value and writes past the buffer.
net_output_datalen() has a similar signed/unsigned issue.
__Impact__
CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5 High)
CWE-787 (Out-of-bounds Write), CWE-191 (Integer Underflow)
An unauthenticated attacker with network access to telnetd can trigger
the write during option negotiation, before the login prompt. ASan reports
a global-buffer-overflow write at netobuf+8256; non-ASan builds can be
driven to SIGSEGV.
Proof of Concept
1. Start GNU Inetutils telnetd (e.g. with inetd or run telnetd manually)
so it accepts Telnet connections.
2. Connect and complete the initial option negotiation (TTYPE, TSPEED,
XDISPLOC, NEW/OLD-ENVIRON, STATUS). Do not read the server's output, or
otherwise keep it backpressured.
3. Use AYT and option/STATUS replies to move nfrontp to netobuf + BUFSIZ.
4. Send IAC AYT. remaining becomes zero; the next output writes past
netobuf. Continuing AYT writes reaches the end of the BSS mapping and
crashes the telnetd process.
A minimal reproducer and the exact byte accounting are available on request.
Credit Request
h1ei1
Best regards,
h1ei1
