41 lines
2.1 KiB
Markdown
41 lines
2.1 KiB
Markdown
# CVE-2020-7039: libslirp/Slirp memory-safety bugs (heap overflow, use-after-free, OOB access) in the user-mode network stack
|
|
|
|
**Scope:** [audit](../README.md) · [README](../../README.md) · [COMPARISON](../../COMPARISON.md) · [docs/RESEARCH](../../docs/RESEARCH.md)
|
|
|
|
Red Hat RHSA-2020:0889 (Important), bundling CVE-2019-14378, CVE-2019-15890, CVE-2020-7039, CVE-2020-8608; related CVE-2020-10756 and CVE-2020-29130 fixed later in libslirp.
|
|
|
|
## Source
|
|
|
|
- [Red Hat RHSA-2020:0889](https://access.redhat.com/errata/RHSA-2020:0889)
|
|
- [SUSE/openSUSE advisory for CVE-2020-10756 and CVE-2020-29130](https://tenable.com/plugins/nessus/159219)
|
|
|
|
## Relevance to doos
|
|
|
|
slirp4netns, doos's default network mode, links libslirp to provide user-mode TCP/IP.
|
|
Several memory-safety bugs were found and fixed in that code between 2019 and 2022: a
|
|
heap overflow, a use-after-free, and multiple out-of-bounds accesses while parsing
|
|
network traffic the sandboxed process generates or receives. Since slirp4netns runs as
|
|
the invoking user's own process (not root, not setuid), a bug here is a crash or, in the
|
|
worst case, code execution as that same user, not a privilege escalation, but it is the
|
|
one piece of doos's default path written in C and parsing attacker-reachable network
|
|
data, so it belongs in this audit's named list rather than being assumed fine by default.
|
|
|
|
|
|
## What the check does
|
|
|
|
Runs `slirp4netns --version` and reads its embedded `libslirp:` version line, compared
|
|
against the fixed releases for this CVE cluster (4.3.1 for the 2020 OOB/UAF bugs; the
|
|
2019 heap overflow was fixed earlier still). No exploit code: these are memory-corruption
|
|
bugs in a dependency, not something to trigger against the host running the check.
|
|
|
|
|
|
## Caveats
|
|
|
|
`slirp4netns --version` reports the libslirp version it was built against; a
|
|
distribution that backports fixes without bumping that string would not be visible to
|
|
this check. Covers only `slirp4netns`/libslirp; `pasta` (passt) is a separate codebase
|
|
and is not covered by this entry.
|
|
|
|
|
|
Run: `make test` in this directory, or `make -C audit test` from the repo root.
|