Re: [FD] Three vulnerabilities found in MikroTik's RouterOS
[update 2022/05/30] Two CVEs have been assigned to these vulnerabilities. CVE-2021-36613: Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the ptp process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference). CVE-2021-36614: Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the tr069-client process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference). Q C 于2021年7月6日周二 19:26写道： > Advisory: three vulnerabilities found in MikroTik's RouterOS > > > Details > === > > Product: MikroTik's RouterOS > Vendor URL: https://mikrotik.com/ > Vendor Status: fixed version released > CVE: - > Credit: Qian Chen(@cq674350529) from Codesafe Team of Legendsec at > Qi'anxin Group > > > Product Description > == > > RouterOS is the operating system used on MikroTik's devices, such as > switch, router and access point. > > > Description of vulnerabilities > == > 1. reachable assertion failure > The netwatch process suffers from an assertion failure vulnerability. > There is a reachable assertion in the netwatch process. By sending a > crafted packet, an authenticated remote user can crash the netwatch process > due to assertion failure. > > Against stable 6.47, the poc resulted in the following crash dump. > > # cat /rw/logs/backtrace.log > 2020.06.29-14:27:25.52@0: > 2020.06.29-14:27:25.52@0: > 2020.06.29-14:27:25.52@0: /ram/pckg/advanced-tools/nova/bin/netwatch > 2020.06.29-14:27:25.52@0: --- signal=6 > > 2020.06.29-14:27:25.52@0: > 2020.06.29-14:27:25.52@0: eip=0x776b855b eflags=0x0246 > 2020.06.29-14:27:25.52@0: edi=0x esi=0x776c0200 > ebp=0x7feea6a0 esp=0x7feea698 > 2020.06.29-14:27:25.52@0: eax=0x ebx=0x00b8 > ecx=0x00b8 edx=0x0006 > 2020.06.29-14:27:25.52@0: > 2020.06.29-14:27:25.52@0: maps: > 2020.06.29-14:27:25.52@0: 08048000-0804d000 r-xp 00:10 14 > /ram/pckg/advanced-tools/nova/bin/netwatch > 2020.06.29-14:27:25.52@0: 7768a000-776bf000 r-xp 00:0c 966 > /lib/libuClibc-0.9.33.2.so > 2020.06.29-14:27:25.52@0: 776c3000-776dd000 r-xp 00:0c 962 > /lib/libgcc_s.so.1 > 2020.06.29-14:27:25.52@0: 776de000-776ed000 r-xp 00:0c 945 > /lib/libuc++.so > 2020.06.29-14:27:25.52@0: 776ee000-7773a000 r-xp 00:0c 947 > /lib/libumsg.so > 2020.06.29-14:27:25.52@0: 7774-77747000 r-xp 00:0c 960 > /lib/ld-uClibc-0.9.33.2.so > 2020.06.29-14:27:25.52@0: > 2020.06.29-14:27:25.52@0: stack: 0x7feeb000 - 0x7feea698 > 2020.06.29-14:27:25.52@0: 00 00 6c 77 00 00 6c 77 d8 a6 ee 7f 77 40 > 6b 77 06 00 00 00 00 02 6c 77 20 00 00 00 00 00 00 00 > 2020.06.29-14:27:25.52@0: bc b0 ee 7f 38 a7 ee 7f d4 a6 ee 7f f4 aa > 73 77 b8 a6 ee 7f f4 aa 73 77 bc b0 ee 7f ff ff ff ff > 2020.06.29-14:27:25.52@0: > 2020.06.29-14:27:25.52@0: code: 0x776b855b > 2020.06.29-14:27:25.52@0: 5b 3d 00 f0 ff ff 76 0e 8b 93 cc ff ff ff > f7 d8 > > This vulnerability was initially found in stable 6.46.2, and it seems that > the latest stable version 6.48.3 still suffers from this vulnerability. > > 2. NULL pointer dereference > The tr069-client process suffers from a memory corruption vulnerability. > By sending a crafted packet, an authenticated remote user can crash the > tr069-client process due to NULL pointer dereference. > > Against stable 6.47, the poc resulted in the following crash dump. > > # cat /rw/logs/backtrace.log > 2020.06.10-17:04:17.63@0: > 2020.06.10-17:04:17.63@0: > 2020.06.10-17:04:17.63@0: /ram/pckg/tr069-client/nova/bin/tr069-client > 2020.06.10-17:04:17.63@0: --- signal=11 > > 2020.06.10-17:04:17.63@0: > 2020.06.10-17:04:17.63@0: eip=0x0805a185 eflags=0x00010206 > 2020.06.10-17:04:17.63@0: edi=0x7ff74a04 esi=0x7ff74a04 > ebp=0x7ff74988 esp=0x7ff7497c > 2020.06.10-17:04:17.63@0: eax=0x ebx=0x080a9290 > ecx=0x776924ec edx=0x7769187c > 2020.06.10-17:04:17.63@0: > 2020.06.10-17:04:17.63@0: maps: > 2020.06.10-17:04:17.63@0: 08048000-08096000 r-xp 00:10 13 > /ram/pckg/tr069-client/nova/bin/tr069-client > 2020.06.10-17:04:17.63@0: 7762f000-77664000 r-xp 00:0c 966 > /lib/libuClibc-0.9.33.2.so > 2020.06.10-17:04:17.63@0: 77668000-77682000 r-xp 00:0c 962 > /lib/libgcc_s.so.1 > 2020.06.10-17:04:17.63@0: 77683000-77692000 r-xp 00:0c 945 > /lib/libuc++.so > 2020.06.10-17:04:17.63@0: 77693000-7769d000 r-xp 00:0c 963 > /lib/libm-0.9.33.2.so > 2020.06.10-17:04:17.63@0: 7769f000-776bc000 r-xp 00:0c 948 > /lib/libucrypto.so > 2020.06.10-17:04:17.63@0: 776bd000-776c r-xp 00:0c 954 > /lib/libxml.so
[FD] Three vulnerabilities found in MikroTik's RouterOS
Advisory: three vulnerabilities found in MikroTik's RouterOS Details === Product: MikroTik's RouterOS Vendor URL: https://mikrotik.com/ Vendor Status: fixed version released CVE: - Credit: Qian Chen(@cq674350529) from Codesafe Team of Legendsec at Qi'anxin Group Product Description == RouterOS is the operating system used on MikroTik's devices, such as switch, router and access point. Description of vulnerabilities == 1. reachable assertion failure The netwatch process suffers from an assertion failure vulnerability. There is a reachable assertion in the netwatch process. By sending a crafted packet, an authenticated remote user can crash the netwatch process due to assertion failure. Against stable 6.47, the poc resulted in the following crash dump. # cat /rw/logs/backtrace.log 2020.06.29-14:27:25.52@0: 2020.06.29-14:27:25.52@0: 2020.06.29-14:27:25.52@0: /ram/pckg/advanced-tools/nova/bin/netwatch 2020.06.29-14:27:25.52@0: --- signal=6 2020.06.29-14:27:25.52@0: 2020.06.29-14:27:25.52@0: eip=0x776b855b eflags=0x0246 2020.06.29-14:27:25.52@0: edi=0x esi=0x776c0200 ebp=0x7feea6a0 esp=0x7feea698 2020.06.29-14:27:25.52@0: eax=0x ebx=0x00b8 ecx=0x00b8 edx=0x0006 2020.06.29-14:27:25.52@0: 2020.06.29-14:27:25.52@0: maps: 2020.06.29-14:27:25.52@0: 08048000-0804d000 r-xp 00:10 14 /ram/pckg/advanced-tools/nova/bin/netwatch 2020.06.29-14:27:25.52@0: 7768a000-776bf000 r-xp 00:0c 966 /lib/libuClibc-0.9.33.2.so 2020.06.29-14:27:25.52@0: 776c3000-776dd000 r-xp 00:0c 962 /lib/libgcc_s.so.1 2020.06.29-14:27:25.52@0: 776de000-776ed000 r-xp 00:0c 945 /lib/libuc++.so 2020.06.29-14:27:25.52@0: 776ee000-7773a000 r-xp 00:0c 947 /lib/libumsg.so 2020.06.29-14:27:25.52@0: 7774-77747000 r-xp 00:0c 960 /lib/ld-uClibc-0.9.33.2.so 2020.06.29-14:27:25.52@0: 2020.06.29-14:27:25.52@0: stack: 0x7feeb000 - 0x7feea698 2020.06.29-14:27:25.52@0: 00 00 6c 77 00 00 6c 77 d8 a6 ee 7f 77 40 6b 77 06 00 00 00 00 02 6c 77 20 00 00 00 00 00 00 00 2020.06.29-14:27:25.52@0: bc b0 ee 7f 38 a7 ee 7f d4 a6 ee 7f f4 aa 73 77 b8 a6 ee 7f f4 aa 73 77 bc b0 ee 7f ff ff ff ff 2020.06.29-14:27:25.52@0: 2020.06.29-14:27:25.52@0: code: 0x776b855b 2020.06.29-14:27:25.52@0: 5b 3d 00 f0 ff ff 76 0e 8b 93 cc ff ff ff f7 d8 This vulnerability was initially found in stable 6.46.2, and it seems that the latest stable version 6.48.3 still suffers from this vulnerability. 2. NULL pointer dereference The tr069-client process suffers from a memory corruption vulnerability. By sending a crafted packet, an authenticated remote user can crash the tr069-client process due to NULL pointer dereference. Against stable 6.47, the poc resulted in the following crash dump. # cat /rw/logs/backtrace.log 2020.06.10-17:04:17.63@0: 2020.06.10-17:04:17.63@0: 2020.06.10-17:04:17.63@0: /ram/pckg/tr069-client/nova/bin/tr069-client 2020.06.10-17:04:17.63@0: --- signal=11 2020.06.10-17:04:17.63@0: 2020.06.10-17:04:17.63@0: eip=0x0805a185 eflags=0x00010206 2020.06.10-17:04:17.63@0: edi=0x7ff74a04 esi=0x7ff74a04 ebp=0x7ff74988 esp=0x7ff7497c 2020.06.10-17:04:17.63@0: eax=0x ebx=0x080a9290 ecx=0x776924ec edx=0x7769187c 2020.06.10-17:04:17.63@0: 2020.06.10-17:04:17.63@0: maps: 2020.06.10-17:04:17.63@0: 08048000-08096000 r-xp 00:10 13 /ram/pckg/tr069-client/nova/bin/tr069-client 2020.06.10-17:04:17.63@0: 7762f000-77664000 r-xp 00:0c 966 /lib/libuClibc-0.9.33.2.so 2020.06.10-17:04:17.63@0: 77668000-77682000 r-xp 00:0c 962 /lib/libgcc_s.so.1 2020.06.10-17:04:17.63@0: 77683000-77692000 r-xp 00:0c 945 /lib/libuc++.so 2020.06.10-17:04:17.63@0: 77693000-7769d000 r-xp 00:0c 963 /lib/libm-0.9.33.2.so 2020.06.10-17:04:17.63@0: 7769f000-776bc000 r-xp 00:0c 948 /lib/libucrypto.so 2020.06.10-17:04:17.63@0: 776bd000-776c r-xp 00:0c 954 /lib/libxml.so 2020.06.10-17:04:17.63@0: 776c1000-7770d000 r-xp 00:0c 947 /lib/libumsg.so 2020.06.10-17:04:17.63@0: 7771-7771b000 r-xp 00:0c 955 /lib/libuhttp.so 2020.06.10-17:04:17.63@0: 7771c000-77724000 r-xp 00:0c 951 /lib/libubox.so 2020.06.10-17:04:17.63@0: 77728000-7772f000 r-xp 00:0c 960 /lib/ld-uClibc-0.9.33.2.so 2020.06.10-17:04:17.63@0: 2020.06.10-17:04:17.63@0: stack: 0x7ff75000 - 0x7ff7497c 2020.06.10-17:04:17.63@0: 10 a0 08 08 40 4b 72 77 90 92 0a 08 b8 49 f7 7f 7c fa 71 77 90 92 0a 08 04 4a f7 7f 05 00 00 00 2020.06.10-17:04:17.63@0: 28 4a f7 7f b4 49 f7 7f 40 4b 72 77 88 5b 09 08 40 4b 72 77 80 4d f7 7f 04 4a f7 7f 28 4a f7 7f 2020.06.10-17:04:17.63@0:
Re: [FD] Three vulnerabilities found in MikroTik's RouterOS
Got it! Thank you for the explanation! On Sat, May 8, 2021 at 4:53 AM Q C wrote: > Hi, > > In Mikrotik RouterOs, each user is assigned to a user group, which denotes > the rights of this user. A group policy is a combination of individual > policy items, and provides a convenient way to assign different permissions > and access rights to different user classes.(Reference: > https://help.mikrotik.com/docs/display/ROS/User) > > Some common individual policy items are: web, winbox, read, write, reboot > and so on. Among of them, reboot is treated as a separate permission. So an > authenticated user may not have the permission to reboot the device. > > As to these vulnerabilities (or software bugs?), reboot permission is not > required to trigger them. And they may pose an impact on the system > services or even reboot the system. Of course, since authentication is > still necessary to trigger them, they have a low impact. > > Thanks! > > > Gynvael Coldwind 于2021年5月8日周六 上午12:09写道： > >> Hi, >> >> I might be missing something, but how are these considered >> vulnerabilities? >> My point is that these require authentication, and an already >> authenticated user already has permissions to reboot the device anyway, >> right? >> >> If the above assumption is correct, then there isn't really a security >> boundary breach, so it would be a software bug, but not a vulnerability. >> Or am I missing something? >> >> Thanks, >> Gynvael >> >> On Fri, May 7, 2021 at 5:51 PM Q C wrote: >> >>> [update 2021/05/04] Three CVEs have been assigned to these >>> vulnerabilities. >>> >>> CVE-2020-20215: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a >>> memory corruption vulnerability in the /nova/bin/diskd process. An >>> authenticated remote attacker can cause a Denial of Service due to >>> invalid >>> memory access. >>> >>> CVE-2020-20216: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a >>> memory corruption vulnerability in the /nova/bin/graphing process. An >>> authenticated remote attacker can cause a Denial of Service (NULL pointer >>> dereference) >>> >>> CVE-2020-20213: Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an >>> stack exhaustion vulnerability in the /nova/bin/net process. An >>> authenticated remote attacker can cause a Denial of Service due to >>> overloading the systems CPU >>> >>> >>> >>> Q C 于2020年7月22日周三 下午8:11写道： >>> >>> > Advisory: three vulnerabilities found in MikroTik's RouterOS >>> > >>> > >>> > Details >>> > === >>> > >>> > Product: MikroTik's RouterOS >>> > Vendor URL: https://mikrotik.com/ >>> > Vendor Status: fixed version released >>> > CVE: - >>> > Credit: Qian Chen(@cq674350529) of Qihoo 360 Nirvan Team >>> > >>> > >>> > Product Description >>> > == >>> > >>> > RouterOS is the operating system used on the MikroTik's devices, such >>> as >>> > switch, router and access point. >>> > >>> > >>> > Description of vulnerabilities >>> > == >>> > >>> > 1. Memory corruption vulnerability >>> > The diskd process suffers from a memory corruption vulnerability. By >>> > sending a crafted packet, an authenticated remote user can crash the >>> diskd >>> > process due to invalid memory access. >>> > >>> > Against stable 6.44.3, the poc resulted in the following crash dump. >>> > >>> > # cat /rw/logs/backtrace.log >>> > 2020.06.04-14:18:22.55@0: >>> > 2020.06.04-14:18:22.55@0: >>> > 2020.06.04-14:18:22.55@0: /nova/bin/diskd >>> > 2020.06.04-14:18:22.55@0: --- signal=11 >>> > >>> > 2020.06.04-14:18:22.55@0: >>> > 2020.06.04-14:18:22.55@0: eip=0x776cd1db eflags=0x00010202 >>> > 2020.06.04-14:18:22.55@0: edi=0x08056760 esi=0x08056790 >>> > ebp=0x7fd40b78 esp=0x7fd40b6c >>> > 2020.06.04-14:18:22.55@0: eax=0x001b ebx=0x776d54ec >>> > ecx=0x776d54ec edx=0x20fe0010 >>> > 2020.06.04-14:18:22.55@0: >>> > 2020.06.04-14:18:22.55@0: maps: >>> > 2020.06.04-14:18:22.55@0: 08048000-08052000 r-xp 00:0c >>> 1131 >>> > /nova/bin/diskd >>> > 2020.06.04-14:18:22.55@0: 77672000-776a7000 r-xp 00:0c >>> 996 >>> > /lib/libuClibc-0.9.33.2.so >>> > 2020.06.04-14:18:22.55@0: 776ab000-776c5000 r-xp 00:0c >>> 992 >>> > /lib/libgcc_s.so.1 >>> > 2020.06.04-14:18:22.55@0: 776c6000-776d5000 r-xp 00:0c >>> 976 >>> > /lib/libuc++.so >>> > 2020.06.04-14:18:22.55@0: 776d6000-776de000 r-xp 00:0c >>> 982 >>> > /lib/libubox.so >>> > 2020.06.04-14:18:22.55@0: 776df000-7772b000 r-xp 00:0c >>> 978 >>> > /lib/libumsg.so >>> > 2020.06.04-14:18:22.55@0: 77731000-77738000 r-xp 00:0c >>> 990 >>> > /lib/ld-uClibc-0.9.33.2.so >>> > 2020.06.04-14:18:22.55@0: >>> > 2020.06.04-14:18:22.55@0: stack: 0x7fd41000 - 0x7fd40b6c >>> > 2020.06.04-14:18:22.55@0: ec 54 6d 77 1b 00 00 00 88 67 05 08 98 >>> 0b >>> > d4 7f c6 c6 04 08 88 67 05 08 1b 00 00 00 10 00 fe 20
Re: [FD] Three vulnerabilities found in MikroTik's RouterOS
Hi, In Mikrotik RouterOs, each user is assigned to a user group, which denotes the rights of this user. A group policy is a combination of individual policy items, and provides a convenient way to assign different permissions and access rights to different user classes.(Reference: https://help.mikrotik.com/docs/display/ROS/User) Some common individual policy items are: web, winbox, read, write, reboot and so on. Among of them, reboot is treated as a separate permission. So an authenticated user may not have the permission to reboot the device. As to these vulnerabilities (or software bugs?), reboot permission is not required to trigger them. And they may pose an impact on the system services or even reboot the system. Of course, since authentication is still necessary to trigger them, they have a low impact. Thanks! Gynvael Coldwind 于2021年5月8日周六 上午12:09写道： > Hi, > > I might be missing something, but how are these considered vulnerabilities? > My point is that these require authentication, and an already > authenticated user already has permissions to reboot the device anyway, > right? > > If the above assumption is correct, then there isn't really a security > boundary breach, so it would be a software bug, but not a vulnerability. > Or am I missing something? > > Thanks, > Gynvael > > On Fri, May 7, 2021 at 5:51 PM Q C wrote: > >> [update 2021/05/04] Three CVEs have been assigned to these >> vulnerabilities. >> >> CVE-2020-20215: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a >> memory corruption vulnerability in the /nova/bin/diskd process. An >> authenticated remote attacker can cause a Denial of Service due to invalid >> memory access. >> >> CVE-2020-20216: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a >> memory corruption vulnerability in the /nova/bin/graphing process. An >> authenticated remote attacker can cause a Denial of Service (NULL pointer >> dereference) >> >> CVE-2020-20213: Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an >> stack exhaustion vulnerability in the /nova/bin/net process. An >> authenticated remote attacker can cause a Denial of Service due to >> overloading the systems CPU >> >> >> >> Q C 于2020年7月22日周三 下午8:11写道： >> >> > Advisory: three vulnerabilities found in MikroTik's RouterOS >> > >> > >> > Details >> > === >> > >> > Product: MikroTik's RouterOS >> > Vendor URL: https://mikrotik.com/ >> > Vendor Status: fixed version released >> > CVE: - >> > Credit: Qian Chen(@cq674350529) of Qihoo 360 Nirvan Team >> > >> > >> > Product Description >> > == >> > >> > RouterOS is the operating system used on the MikroTik's devices, such as >> > switch, router and access point. >> > >> > >> > Description of vulnerabilities >> > == >> > >> > 1. Memory corruption vulnerability >> > The diskd process suffers from a memory corruption vulnerability. By >> > sending a crafted packet, an authenticated remote user can crash the >> diskd >> > process due to invalid memory access. >> > >> > Against stable 6.44.3, the poc resulted in the following crash dump. >> > >> > # cat /rw/logs/backtrace.log >> > 2020.06.04-14:18:22.55@0: >> > 2020.06.04-14:18:22.55@0: >> > 2020.06.04-14:18:22.55@0: /nova/bin/diskd >> > 2020.06.04-14:18:22.55@0: --- signal=11 >> > >> > 2020.06.04-14:18:22.55@0: >> > 2020.06.04-14:18:22.55@0: eip=0x776cd1db eflags=0x00010202 >> > 2020.06.04-14:18:22.55@0: edi=0x08056760 esi=0x08056790 >> > ebp=0x7fd40b78 esp=0x7fd40b6c >> > 2020.06.04-14:18:22.55@0: eax=0x001b ebx=0x776d54ec >> > ecx=0x776d54ec edx=0x20fe0010 >> > 2020.06.04-14:18:22.55@0: >> > 2020.06.04-14:18:22.55@0: maps: >> > 2020.06.04-14:18:22.55@0: 08048000-08052000 r-xp 00:0c >> 1131 >> > /nova/bin/diskd >> > 2020.06.04-14:18:22.55@0: 77672000-776a7000 r-xp 00:0c 996 >> > /lib/libuClibc-0.9.33.2.so >> > 2020.06.04-14:18:22.55@0: 776ab000-776c5000 r-xp 00:0c 992 >> > /lib/libgcc_s.so.1 >> > 2020.06.04-14:18:22.55@0: 776c6000-776d5000 r-xp 00:0c 976 >> > /lib/libuc++.so >> > 2020.06.04-14:18:22.55@0: 776d6000-776de000 r-xp 00:0c 982 >> > /lib/libubox.so >> > 2020.06.04-14:18:22.55@0: 776df000-7772b000 r-xp 00:0c 978 >> > /lib/libumsg.so >> > 2020.06.04-14:18:22.55@0: 77731000-77738000 r-xp 00:0c 990 >> > /lib/ld-uClibc-0.9.33.2.so >> > 2020.06.04-14:18:22.55@0: >> > 2020.06.04-14:18:22.55@0: stack: 0x7fd41000 - 0x7fd40b6c >> > 2020.06.04-14:18:22.55@0: ec 54 6d 77 1b 00 00 00 88 67 05 08 98 0b >> > d4 7f c6 c6 04 08 88 67 05 08 1b 00 00 00 10 00 fe 20 >> > 2020.06.04-14:18:22.55@0: 10 00 fe 20 ec 54 6d 77 f0 ea 6d 77 08 0c >> > d4 7f 6d a9 6d 77 88 67 05 08 1b 00 00 00 05 00 00 00 >> > 2020.06.04-14:18:22.55@0: >> > 2020.06.04-14:18:22.55@0: code: 0x776cd1db >> > 2020.06.04-14:18:22.55@0: 8b
Re: [FD] Three vulnerabilities found in MikroTik's RouterOS
Hi, I might be missing something, but how are these considered vulnerabilities? My point is that these require authentication, and an already authenticated user already has permissions to reboot the device anyway, right? If the above assumption is correct, then there isn't really a security boundary breach, so it would be a software bug, but not a vulnerability. Or am I missing something? Thanks, Gynvael On Fri, May 7, 2021 at 5:51 PM Q C wrote: > [update 2021/05/04] Three CVEs have been assigned to these vulnerabilities. > > CVE-2020-20215: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a > memory corruption vulnerability in the /nova/bin/diskd process. An > authenticated remote attacker can cause a Denial of Service due to invalid > memory access. > > CVE-2020-20216: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a > memory corruption vulnerability in the /nova/bin/graphing process. An > authenticated remote attacker can cause a Denial of Service (NULL pointer > dereference) > > CVE-2020-20213: Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an > stack exhaustion vulnerability in the /nova/bin/net process. An > authenticated remote attacker can cause a Denial of Service due to > overloading the systems CPU > > > > Q C 于2020年7月22日周三 下午8:11写道： > > > Advisory: three vulnerabilities found in MikroTik's RouterOS > > > > > > Details > > === > > > > Product: MikroTik's RouterOS > > Vendor URL: https://mikrotik.com/ > > Vendor Status: fixed version released > > CVE: - > > Credit: Qian Chen(@cq674350529) of Qihoo 360 Nirvan Team > > > > > > Product Description > > == > > > > RouterOS is the operating system used on the MikroTik's devices, such as > > switch, router and access point. > > > > > > Description of vulnerabilities > > == > > > > 1. Memory corruption vulnerability > > The diskd process suffers from a memory corruption vulnerability. By > > sending a crafted packet, an authenticated remote user can crash the > diskd > > process due to invalid memory access. > > > > Against stable 6.44.3, the poc resulted in the following crash dump. > > > > # cat /rw/logs/backtrace.log > > 2020.06.04-14:18:22.55@0: > > 2020.06.04-14:18:22.55@0: > > 2020.06.04-14:18:22.55@0: /nova/bin/diskd > > 2020.06.04-14:18:22.55@0: --- signal=11 > > > > 2020.06.04-14:18:22.55@0: > > 2020.06.04-14:18:22.55@0: eip=0x776cd1db eflags=0x00010202 > > 2020.06.04-14:18:22.55@0: edi=0x08056760 esi=0x08056790 > > ebp=0x7fd40b78 esp=0x7fd40b6c > > 2020.06.04-14:18:22.55@0: eax=0x001b ebx=0x776d54ec > > ecx=0x776d54ec edx=0x20fe0010 > > 2020.06.04-14:18:22.55@0: > > 2020.06.04-14:18:22.55@0: maps: > > 2020.06.04-14:18:22.55@0: 08048000-08052000 r-xp 00:0c 1131 > > /nova/bin/diskd > > 2020.06.04-14:18:22.55@0: 77672000-776a7000 r-xp 00:0c 996 > > /lib/libuClibc-0.9.33.2.so > > 2020.06.04-14:18:22.55@0: 776ab000-776c5000 r-xp 00:0c 992 > > /lib/libgcc_s.so.1 > > 2020.06.04-14:18:22.55@0: 776c6000-776d5000 r-xp 00:0c 976 > > /lib/libuc++.so > > 2020.06.04-14:18:22.55@0: 776d6000-776de000 r-xp 00:0c 982 > > /lib/libubox.so > > 2020.06.04-14:18:22.55@0: 776df000-7772b000 r-xp 00:0c 978 > > /lib/libumsg.so > > 2020.06.04-14:18:22.55@0: 77731000-77738000 r-xp 00:0c 990 > > /lib/ld-uClibc-0.9.33.2.so > > 2020.06.04-14:18:22.55@0: > > 2020.06.04-14:18:22.55@0: stack: 0x7fd41000 - 0x7fd40b6c > > 2020.06.04-14:18:22.55@0: ec 54 6d 77 1b 00 00 00 88 67 05 08 98 0b > > d4 7f c6 c6 04 08 88 67 05 08 1b 00 00 00 10 00 fe 20 > > 2020.06.04-14:18:22.55@0: 10 00 fe 20 ec 54 6d 77 f0 ea 6d 77 08 0c > > d4 7f 6d a9 6d 77 88 67 05 08 1b 00 00 00 05 00 00 00 > > 2020.06.04-14:18:22.55@0: > > 2020.06.04-14:18:22.55@0: code: 0x776cd1db > > 2020.06.04-14:18:22.55@0: 8b 00 8b 10 01 c2 83 c2 04 52 83 c0 04 50 > > ff 75 > > > > This vulnerability was initially found in long-term 6.44.5, and has been > > fixed in stable 6.47. > > > > 2. NULL pointer dereference vulnerability > > The graphing process suffers from a memory corruption vulnerability. By > > sending a crafted packet, an authenticated remote user can crash the > > graphing process due to NULL > > pointer dereference. > > > > Against stable 6.46.5, the poc resulted in the following crash dump. > > > > # cat /rw/logs/backtrace.log > > 2020.06.04-15:12:41.47@0: > > 2020.06.04-15:12:41.47@0: > > 2020.06.04-15:12:41.47@0: /nova/bin/graphing > > 2020.06.04-15:12:41.47@0: --- signal=11 > > > > 2020.06.04-15:12:41.47@0: > > 2020.06.04-15:12:41.47@0: eip=0x080521e2 eflags=0x00010202 > > 2020.06.04-15:12:41.47@0: edi=0x080610a0 esi=0x08061cb8 > > ebp=0x7fa8acd8 esp=0x7fa8acb0 > > 2020.06.04-15:12:41.47@0: eax=0x08061db8
Re: [FD] Three vulnerabilities found in MikroTik's RouterOS
[Update 2021/05/04] Three CVEs have been assigned to these vulnerabilities. CVE-2020-20266: Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/dot1x process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference). CVE-2020-20264: Mikrotik RouterOs before 6.47 (stable tree) in the /ram/pckg/advanced-tools/nova/bin/netwatch process. An authenticated remote attacker can cause a Denial of Service due to a divide by zero error. CVE-2020-20265: Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /ram/pckg/wireless/nova/bin/wireless process. An authenticated remote attacker can cause a Denial of Service due via a crafted packet. Q C 于2020年8月27日周四 下午7:16写道： > Advisory: three vulnerabilities found in MikroTik's RouterOS > > > Details > === > > Product: MikroTik's RouterOS > Vendor URL: https://mikrotik.com/ > Vendor Status: fixed version released > CVE: - > Credit: Qian Chen(@cq674350529) of Qihoo 360 Nirvan Team > > > Product Description > == > > RouterOS is the operating system used on the MikroTik's devices, such as > switch, router and access point. > > > Description of vulnerabilities > == > > 1. NULL pointer dereference > The dot1x process suffers from a memory corruption vulnerability. By > sending a crafted packet, an authenticated remote user can crash the dot1x > process due to NULL pointer dereference. > > Against stable 6.46.5, the poc resulted in the following crash dump. > > # cat /rw/logs/backtrace.log > 2020.06.04-14:51:29.47@0: > 2020.06.04-14:51:29.47@0: > 2020.06.04-14:51:29.81@0: /nova/bin/dot1x > 2020.06.04-14:51:29.81@0: --- signal=11 > > 2020.06.04-14:51:29.81@0: > 2020.06.04-14:51:29.81@0: eip=0x776a51e5 eflags=0x00010202 > 2020.06.04-14:51:29.81@0: edi=0x7fc51064 esi=0x08062ed0 > ebp=0x7fc50f78 esp=0x7fc50f6c > 2020.06.04-14:51:29.81@0: eax=0x ebx=0x776ad4ec > ecx=0x edx=0x08062e28 > 2020.06.04-14:51:29.81@0: > 2020.06.04-14:51:29.81@0: maps: > 2020.06.04-14:51:29.81@0: 08048000-0805f000 r-xp 00:0c 1064 > /nova/bin/dot1x > 2020.06.04-14:51:29.81@0: 7764a000-7767f000 r-xp 00:0c 964 > /lib/libuClibc-0.9.33.2.so > 2020.06.04-14:51:29.81@0: 77683000-7769d000 r-xp 00:0c 960 > /lib/libgcc_s.so.1 > 2020.06.04-14:51:29.81@0: 7769e000-776ad000 r-xp 00:0c 944 > /lib/libuc++.so > 2020.06.04-14:51:29.81@0: 776ae000-776b4000 r-xp 00:0c 951 > /lib/liburadius.so > 2020.06.04-14:51:29.81@0: 776b5000-776bd000 r-xp 00:0c 950 > /lib/libubox.so > 2020.06.04-14:51:29.81@0: 776be000-776db000 r-xp 00:0c 947 > /lib/libucrypto.so > 2020.06.04-14:51:29.81@0: 776dc000-77728000 r-xp 00:0c 946 > /lib/libumsg.so > 2020.06.04-14:51:29.81@0: 7772e000-77735000 r-xp 00:0c 958 > /lib/ld-uClibc-0.9.33.2.so > 2020.06.04-14:51:29.81@0: > 2020.06.04-14:51:29.81@0: stack: 0x7fc52000 - 0x7fc50f6c > 2020.06.04-14:51:29.81@0: 00 00 00 00 90 27 06 08 e4 8a 72 77 a8 0f > c5 7f 2e be 6f 77 90 27 06 08 d0 2e 06 08 28 2e 06 08 > 2020.06.04-14:51:29.81@0: 28 2e 06 08 a4 0f c5 7f f0 da 6b 77 05 00 > 00 00 f0 da 6b 77 e0 2d 06 08 64 10 c5 7f e8 0f c5 7f > 2020.06.04-14:51:29.81@0: > 2020.06.04-14:51:29.81@0: code: 0x776a51e5 > 2020.06.04-14:51:29.81@0: 8b 10 01 c2 83 c2 04 52 83 c0 04 50 ff 75 > 08 e8 > > This vulnerability was initially found in stable 6.46.3, and was fixed in > stable 6.47. > > 2. division by zero > The netwatch process suffers from a division-by-zero vulnerability. By > sending a crafted packet, an authenticated remote user can crash the > netwatch process due to arithmetic exception. > > Against stable 6.46.5, the poc resulted in the following crash dump. > > # cat /rw/logs/backtrace.log > 2020.06.04-16:25:57.65@0: > 2020.06.04-16:25:57.65@0: > 2020.06.04-16:25:57.65@0: /ram/pckg/advanced-tools/nova/bin/netwatch > 2020.06.04-16:25:57.65@0: --- signal=8 > > 2020.06.04-16:25:57.65@0: > 2020.06.04-16:25:57.65@0: eip=0x0804c6d7 eflags=0x00010246 > 2020.06.04-16:25:57.65@0: edi=0x5ed9208c esi=0x > ebp=0x73f8 esp=0x73b0 > 2020.06.04-16:25:57.65@0: eax=0x ebx=0x08051020 > ecx=0x edx=0x > 2020.06.04-16:25:57.65@0: > 2020.06.04-16:25:57.65@0: maps: > 2020.06.04-16:25:57.65@0: 08048000-0804d000 r-xp 00:1a 14 > /ram/pckg/advanced-tools/nova/bin/netwatch > 2020.06.04-16:25:57.65@0: 77f41000-77f76000 r-xp 00:0c 964 > /lib/libuClibc-0.9.33.2.so > 2020.06.04-16:25:57.65@0: 77f7a000-77f94000 r-xp 00:0c 960 > /lib/libgcc_s.so.1 > 2020.06.04-16:25:57.65@0: 77f95000-77fa4000
Re: [FD] Three vulnerabilities found in MikroTik's RouterOS
[update 2021/05/04] Three CVEs have been assigned to these vulnerabilities. CVE-2020-20215: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/diskd process. An authenticated remote attacker can cause a Denial of Service due to invalid memory access. CVE-2020-20216: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/graphing process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference) CVE-2020-20213: Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an stack exhaustion vulnerability in the /nova/bin/net process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU Q C 于2020年7月22日周三 下午8:11写道： > Advisory: three vulnerabilities found in MikroTik's RouterOS > > > Details > === > > Product: MikroTik's RouterOS > Vendor URL: https://mikrotik.com/ > Vendor Status: fixed version released > CVE: - > Credit: Qian Chen(@cq674350529) of Qihoo 360 Nirvan Team > > > Product Description > == > > RouterOS is the operating system used on the MikroTik's devices, such as > switch, router and access point. > > > Description of vulnerabilities > == > > 1. Memory corruption vulnerability > The diskd process suffers from a memory corruption vulnerability. By > sending a crafted packet, an authenticated remote user can crash the diskd > process due to invalid memory access. > > Against stable 6.44.3, the poc resulted in the following crash dump. > > # cat /rw/logs/backtrace.log > 2020.06.04-14:18:22.55@0: > 2020.06.04-14:18:22.55@0: > 2020.06.04-14:18:22.55@0: /nova/bin/diskd > 2020.06.04-14:18:22.55@0: --- signal=11 > > 2020.06.04-14:18:22.55@0: > 2020.06.04-14:18:22.55@0: eip=0x776cd1db eflags=0x00010202 > 2020.06.04-14:18:22.55@0: edi=0x08056760 esi=0x08056790 > ebp=0x7fd40b78 esp=0x7fd40b6c > 2020.06.04-14:18:22.55@0: eax=0x001b ebx=0x776d54ec > ecx=0x776d54ec edx=0x20fe0010 > 2020.06.04-14:18:22.55@0: > 2020.06.04-14:18:22.55@0: maps: > 2020.06.04-14:18:22.55@0: 08048000-08052000 r-xp 00:0c 1131 > /nova/bin/diskd > 2020.06.04-14:18:22.55@0: 77672000-776a7000 r-xp 00:0c 996 > /lib/libuClibc-0.9.33.2.so > 2020.06.04-14:18:22.55@0: 776ab000-776c5000 r-xp 00:0c 992 > /lib/libgcc_s.so.1 > 2020.06.04-14:18:22.55@0: 776c6000-776d5000 r-xp 00:0c 976 > /lib/libuc++.so > 2020.06.04-14:18:22.55@0: 776d6000-776de000 r-xp 00:0c 982 > /lib/libubox.so > 2020.06.04-14:18:22.55@0: 776df000-7772b000 r-xp 00:0c 978 > /lib/libumsg.so > 2020.06.04-14:18:22.55@0: 77731000-77738000 r-xp 00:0c 990 > /lib/ld-uClibc-0.9.33.2.so > 2020.06.04-14:18:22.55@0: > 2020.06.04-14:18:22.55@0: stack: 0x7fd41000 - 0x7fd40b6c > 2020.06.04-14:18:22.55@0: ec 54 6d 77 1b 00 00 00 88 67 05 08 98 0b > d4 7f c6 c6 04 08 88 67 05 08 1b 00 00 00 10 00 fe 20 > 2020.06.04-14:18:22.55@0: 10 00 fe 20 ec 54 6d 77 f0 ea 6d 77 08 0c > d4 7f 6d a9 6d 77 88 67 05 08 1b 00 00 00 05 00 00 00 > 2020.06.04-14:18:22.55@0: > 2020.06.04-14:18:22.55@0: code: 0x776cd1db > 2020.06.04-14:18:22.55@0: 8b 00 8b 10 01 c2 83 c2 04 52 83 c0 04 50 > ff 75 > > This vulnerability was initially found in long-term 6.44.5, and has been > fixed in stable 6.47. > > 2. NULL pointer dereference vulnerability > The graphing process suffers from a memory corruption vulnerability. By > sending a crafted packet, an authenticated remote user can crash the > graphing process due to NULL > pointer dereference. > > Against stable 6.46.5, the poc resulted in the following crash dump. > > # cat /rw/logs/backtrace.log > 2020.06.04-15:12:41.47@0: > 2020.06.04-15:12:41.47@0: > 2020.06.04-15:12:41.47@0: /nova/bin/graphing > 2020.06.04-15:12:41.47@0: --- signal=11 > > 2020.06.04-15:12:41.47@0: > 2020.06.04-15:12:41.47@0: eip=0x080521e2 eflags=0x00010202 > 2020.06.04-15:12:41.47@0: edi=0x080610a0 esi=0x08061cb8 > ebp=0x7fa8acd8 esp=0x7fa8acb0 > 2020.06.04-15:12:41.47@0: eax=0x08061db8 ebx=0x7fa8ad0c > ecx=0x edx=0x08061ce8 > 2020.06.04-15:12:41.47@0: > 2020.06.04-15:12:41.47@0: maps: > 2020.06.04-15:12:41.47@0: 08048000-0805c000 r-xp 00:0c 1038 > /nova/bin/graphing > 2020.06.04-15:12:41.47@0: 77651000-77686000 r-xp 00:0c 964 > /lib/libuClibc-0.9.33.2.so > 2020.06.04-15:12:41.47@0: 7768a000-776a4000 r-xp 00:0c 960 > /lib/libgcc_s.so.1 > 2020.06.04-15:12:41.47@0: 776a5000-776b4000 r-xp 00:0c 944 > /lib/libuc++.so > 2020.06.04-15:12:41.47@0: 776b5000-776bd000 r-xp 00:0c 950 > /lib/libubox.so > 2020.06.04-15:12:41.47@0: 776be000-7770a000 r-xp
[FD] Three vulnerabilities found in MikroTik's RouterOS
Advisory: three vulnerabilities found in MikroTik's RouterOS Details === Product: MikroTik's RouterOS Vendor URL: https://mikrotik.com/ Vendor Status: fixed version released CVE: - Credit: Qian Chen(@cq674350529) of Qihoo 360 Nirvan Team Product Description == RouterOS is the operating system used on the MikroTik's devices, such as switch, router and access point. Description of vulnerabilities == 1. NULL pointer dereference The dot1x process suffers from a memory corruption vulnerability. By sending a crafted packet, an authenticated remote user can crash the dot1x process due to NULL pointer dereference. Against stable 6.46.5, the poc resulted in the following crash dump. # cat /rw/logs/backtrace.log 2020.06.04-14:51:29.47@0: 2020.06.04-14:51:29.47@0: 2020.06.04-14:51:29.81@0: /nova/bin/dot1x 2020.06.04-14:51:29.81@0: --- signal=11 2020.06.04-14:51:29.81@0: 2020.06.04-14:51:29.81@0: eip=0x776a51e5 eflags=0x00010202 2020.06.04-14:51:29.81@0: edi=0x7fc51064 esi=0x08062ed0 ebp=0x7fc50f78 esp=0x7fc50f6c 2020.06.04-14:51:29.81@0: eax=0x ebx=0x776ad4ec ecx=0x edx=0x08062e28 2020.06.04-14:51:29.81@0: 2020.06.04-14:51:29.81@0: maps: 2020.06.04-14:51:29.81@0: 08048000-0805f000 r-xp 00:0c 1064 /nova/bin/dot1x 2020.06.04-14:51:29.81@0: 7764a000-7767f000 r-xp 00:0c 964 /lib/libuClibc-0.9.33.2.so 2020.06.04-14:51:29.81@0: 77683000-7769d000 r-xp 00:0c 960 /lib/libgcc_s.so.1 2020.06.04-14:51:29.81@0: 7769e000-776ad000 r-xp 00:0c 944 /lib/libuc++.so 2020.06.04-14:51:29.81@0: 776ae000-776b4000 r-xp 00:0c 951 /lib/liburadius.so 2020.06.04-14:51:29.81@0: 776b5000-776bd000 r-xp 00:0c 950 /lib/libubox.so 2020.06.04-14:51:29.81@0: 776be000-776db000 r-xp 00:0c 947 /lib/libucrypto.so 2020.06.04-14:51:29.81@0: 776dc000-77728000 r-xp 00:0c 946 /lib/libumsg.so 2020.06.04-14:51:29.81@0: 7772e000-77735000 r-xp 00:0c 958 /lib/ld-uClibc-0.9.33.2.so 2020.06.04-14:51:29.81@0: 2020.06.04-14:51:29.81@0: stack: 0x7fc52000 - 0x7fc50f6c 2020.06.04-14:51:29.81@0: 00 00 00 00 90 27 06 08 e4 8a 72 77 a8 0f c5 7f 2e be 6f 77 90 27 06 08 d0 2e 06 08 28 2e 06 08 2020.06.04-14:51:29.81@0: 28 2e 06 08 a4 0f c5 7f f0 da 6b 77 05 00 00 00 f0 da 6b 77 e0 2d 06 08 64 10 c5 7f e8 0f c5 7f 2020.06.04-14:51:29.81@0: 2020.06.04-14:51:29.81@0: code: 0x776a51e5 2020.06.04-14:51:29.81@0: 8b 10 01 c2 83 c2 04 52 83 c0 04 50 ff 75 08 e8 This vulnerability was initially found in stable 6.46.3, and was fixed in stable 6.47. 2. division by zero The netwatch process suffers from a division-by-zero vulnerability. By sending a crafted packet, an authenticated remote user can crash the netwatch process due to arithmetic exception. Against stable 6.46.5, the poc resulted in the following crash dump. # cat /rw/logs/backtrace.log 2020.06.04-16:25:57.65@0: 2020.06.04-16:25:57.65@0: 2020.06.04-16:25:57.65@0: /ram/pckg/advanced-tools/nova/bin/netwatch 2020.06.04-16:25:57.65@0: --- signal=8 2020.06.04-16:25:57.65@0: 2020.06.04-16:25:57.65@0: eip=0x0804c6d7 eflags=0x00010246 2020.06.04-16:25:57.65@0: edi=0x5ed9208c esi=0x ebp=0x73f8 esp=0x73b0 2020.06.04-16:25:57.65@0: eax=0x ebx=0x08051020 ecx=0x edx=0x 2020.06.04-16:25:57.65@0: 2020.06.04-16:25:57.65@0: maps: 2020.06.04-16:25:57.65@0: 08048000-0804d000 r-xp 00:1a 14 /ram/pckg/advanced-tools/nova/bin/netwatch 2020.06.04-16:25:57.65@0: 77f41000-77f76000 r-xp 00:0c 964 /lib/libuClibc-0.9.33.2.so 2020.06.04-16:25:57.65@0: 77f7a000-77f94000 r-xp 00:0c 960 /lib/libgcc_s.so.1 2020.06.04-16:25:57.65@0: 77f95000-77fa4000 r-xp 00:0c 944 /lib/libuc++.so 2020.06.04-16:25:57.65@0: 77fa5000-77ff1000 r-xp 00:0c 946 /lib/libumsg.so 2020.06.04-16:25:57.65@0: 77ff7000-77ffe000 r-xp 00:0c 958 /lib/ld-uClibc-0.9.33.2.so 2020.06.04-16:25:57.65@0: 2020.06.04-16:25:57.65@0: stack: 0x8000 - 0x73b0 2020.06.04-16:25:57.65@0: d8 f4 ff 7f 80 f6 ff 7f 06 00 00 00 d0 f3 ff 7f 84 e5 04 08 0b 00 ff 08 e8 f3 ff 7f 06 00 00 00 2020.06.04-16:25:57.65@0: 20 10 05 08 e4 1a ff 77 f8 f3 ff 7f 22 2c fc 77 d8 f4 ff 7f 0b 00 ff 08 08 f4 ff 7f e4 1a ff 77 2020.06.04-16:25:57.65@0: 2020.06.04-16:25:57.65@0: code: 0x804c6d7 2020.06.04-16:25:57.65@0: f7 f6 8b 53 30 39 c2 73 6e 42 89 53 30 83 ec 0c This vulnerability was initially found in stable 6.46.2, and was fixed in stable 6.47. 3. memory corruption The wireless process suffers from a memory corruption vulnerability. By sending a crafted packet, an authenticated remote user can crash the wireless process due to invalid memory
[FD] Three vulnerabilities found in MikroTik's RouterOS
Advisory: three vulnerabilities found in MikroTik's RouterOS Details === Product: MikroTik's RouterOS Vendor URL: https://mikrotik.com/ Vendor Status: fixed version released CVE: - Credit: Qian Chen(@cq674350529) of Qihoo 360 Nirvan Team Product Description == RouterOS is the operating system used on the MikroTik's devices, such as switch, router and access point. Description of vulnerabilities == 1. Memory corruption vulnerability The diskd process suffers from a memory corruption vulnerability. By sending a crafted packet, an authenticated remote user can crash the diskd process due to invalid memory access. Against stable 6.44.3, the poc resulted in the following crash dump. # cat /rw/logs/backtrace.log 2020.06.04-14:18:22.55@0: 2020.06.04-14:18:22.55@0: 2020.06.04-14:18:22.55@0: /nova/bin/diskd 2020.06.04-14:18:22.55@0: --- signal=11 2020.06.04-14:18:22.55@0: 2020.06.04-14:18:22.55@0: eip=0x776cd1db eflags=0x00010202 2020.06.04-14:18:22.55@0: edi=0x08056760 esi=0x08056790 ebp=0x7fd40b78 esp=0x7fd40b6c 2020.06.04-14:18:22.55@0: eax=0x001b ebx=0x776d54ec ecx=0x776d54ec edx=0x20fe0010 2020.06.04-14:18:22.55@0: 2020.06.04-14:18:22.55@0: maps: 2020.06.04-14:18:22.55@0: 08048000-08052000 r-xp 00:0c 1131 /nova/bin/diskd 2020.06.04-14:18:22.55@0: 77672000-776a7000 r-xp 00:0c 996 /lib/libuClibc-0.9.33.2.so 2020.06.04-14:18:22.55@0: 776ab000-776c5000 r-xp 00:0c 992 /lib/libgcc_s.so.1 2020.06.04-14:18:22.55@0: 776c6000-776d5000 r-xp 00:0c 976 /lib/libuc++.so 2020.06.04-14:18:22.55@0: 776d6000-776de000 r-xp 00:0c 982 /lib/libubox.so 2020.06.04-14:18:22.55@0: 776df000-7772b000 r-xp 00:0c 978 /lib/libumsg.so 2020.06.04-14:18:22.55@0: 77731000-77738000 r-xp 00:0c 990 /lib/ld-uClibc-0.9.33.2.so 2020.06.04-14:18:22.55@0: 2020.06.04-14:18:22.55@0: stack: 0x7fd41000 - 0x7fd40b6c 2020.06.04-14:18:22.55@0: ec 54 6d 77 1b 00 00 00 88 67 05 08 98 0b d4 7f c6 c6 04 08 88 67 05 08 1b 00 00 00 10 00 fe 20 2020.06.04-14:18:22.55@0: 10 00 fe 20 ec 54 6d 77 f0 ea 6d 77 08 0c d4 7f 6d a9 6d 77 88 67 05 08 1b 00 00 00 05 00 00 00 2020.06.04-14:18:22.55@0: 2020.06.04-14:18:22.55@0: code: 0x776cd1db 2020.06.04-14:18:22.55@0: 8b 00 8b 10 01 c2 83 c2 04 52 83 c0 04 50 ff 75 This vulnerability was initially found in long-term 6.44.5, and has been fixed in stable 6.47. 2. NULL pointer dereference vulnerability The graphing process suffers from a memory corruption vulnerability. By sending a crafted packet, an authenticated remote user can crash the graphing process due to NULL pointer dereference. Against stable 6.46.5, the poc resulted in the following crash dump. # cat /rw/logs/backtrace.log 2020.06.04-15:12:41.47@0: 2020.06.04-15:12:41.47@0: 2020.06.04-15:12:41.47@0: /nova/bin/graphing 2020.06.04-15:12:41.47@0: --- signal=11 2020.06.04-15:12:41.47@0: 2020.06.04-15:12:41.47@0: eip=0x080521e2 eflags=0x00010202 2020.06.04-15:12:41.47@0: edi=0x080610a0 esi=0x08061cb8 ebp=0x7fa8acd8 esp=0x7fa8acb0 2020.06.04-15:12:41.47@0: eax=0x08061db8 ebx=0x7fa8ad0c ecx=0x edx=0x08061ce8 2020.06.04-15:12:41.47@0: 2020.06.04-15:12:41.47@0: maps: 2020.06.04-15:12:41.47@0: 08048000-0805c000 r-xp 00:0c 1038 /nova/bin/graphing 2020.06.04-15:12:41.47@0: 77651000-77686000 r-xp 00:0c 964 /lib/libuClibc-0.9.33.2.so 2020.06.04-15:12:41.47@0: 7768a000-776a4000 r-xp 00:0c 960 /lib/libgcc_s.so.1 2020.06.04-15:12:41.47@0: 776a5000-776b4000 r-xp 00:0c 944 /lib/libuc++.so 2020.06.04-15:12:41.47@0: 776b5000-776bd000 r-xp 00:0c 950 /lib/libubox.so 2020.06.04-15:12:41.47@0: 776be000-7770a000 r-xp 00:0c 946 /lib/libumsg.so 2020.06.04-15:12:41.47@0: 7770d000-77717000 r-xp 00:0c 961 /lib/libm-0.9.33.2.so 2020.06.04-15:12:41.47@0: 7771c000-77723000 r-xp 00:0c 958 /lib/ld-uClibc-0.9.33.2.so 2020.06.04-15:12:41.47@0: 2020.06.04-15:12:41.47@0: stack: 0x7fa8b000 - 0x7fa8acb0 2020.06.04-15:12:41.47@0: e8 1c 06 08 b8 1d 06 08 00 00 00 00 01 00 00 00 0c ad a8 7f 5b 00 00 00 b8 98 05 08 b8 98 05 08 2020.06.04-15:12:41.47@0: f0 da 6b 77 0c ad a8 7f 28 ad a8 7f 3a bc 6b 77 b8 1c 06 08 0c ad a8 7f 05 00 00 00 a0 10 06 08 2020.06.04-15:12:41.47@0: 2020.06.04-15:12:41.47@0: code: 0x80521e2 2020.06.04-15:12:41.47@0: ff 51 04 83 c4 18 6a 5c 53 e8 a0 9c ff ff 8b 56 This vulnerability was initially found in long-term 6.44.6, and has been fixed in stable 6.47. 3. Stack exhaustion vulnerability The net process suffers from a stack exhaustion vulnerability. By sending a crafted packet to the net process, an authenticated remote user can trigger a stack
