2.1 KiB
CVE-2020-7039: libslirp/Slirp memory-safety bugs (heap overflow, use-after-free, OOB access) in the user-mode network stack
Scope: audit · README · COMPARISON · docs/RESEARCH
Red Hat RHSA-2020:0889 (Important), bundling CVE-2019-14378, CVE-2019-15890, CVE-2020-7039, CVE-2020-8608; related CVE-2020-10756 and CVE-2020-29130 fixed later in libslirp.
Source
Relevance to doos
slirp4netns, doos's default network mode, links libslirp to provide user-mode TCP/IP. Several memory-safety bugs were found and fixed in that code between 2019 and 2022: a heap overflow, a use-after-free, and multiple out-of-bounds accesses while parsing network traffic the sandboxed process generates or receives. Since slirp4netns runs as the invoking user's own process (not root, not setuid), a bug here is a crash or, in the worst case, code execution as that same user, not a privilege escalation, but it is the one piece of doos's default path written in C and parsing attacker-reachable network data, so it belongs in this audit's named list rather than being assumed fine by default.
What the check does
Runs slirp4netns --version and reads its embedded libslirp: version line, compared
against the fixed releases for this CVE cluster (4.3.1 for the 2020 OOB/UAF bugs; the
2019 heap overflow was fixed earlier still). No exploit code: these are memory-corruption
bugs in a dependency, not something to trigger against the host running the check.
Caveats
slirp4netns --version reports the libslirp version it was built against; a
distribution that backports fixes without bumping that string would not be visible to
this check. Covers only slirp4netns/libslirp; pasta (passt) is a separate codebase
and is not covered by this entry.
Run: make test in this directory, or make -C audit test from the repo root.