Challenge Information - CROMU_00072

Commonly known as: Shortest_Path_Tree_Calculator

Rounds Enabled

16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30

Details

Original Versions

Known Vulnerabilities

  • CWE-124 - Buffer Underwrite ('Buffer Underflow')
  • CWE-131 - Incorrect Calculation of Buffer Size
    • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

Author Information

"Joe Rogers" joe@cromulence.com

DARPA performer group

Cromulence (CROMU)

Description

This CB, given a list of nodes and edges as input, calculates the nodes in the shortest path from a given starting node to a given ending node.

Feature List

The CB accepts three commands: - Send Nodes: Allows the user to input a set of nodes - Send Edges: Allows the user to input a set of edges - Run SPT: Instructs the program to calculate the shortest path from a starting to an ending node

Upon completion of the SPT calculation, a list of nodes is sent back to the user.

Vulnerability

The CB has a limit to the number of nodes that it will accept. However, this limit is enforced on each use of the "Send Nodes" command rather than on the total of all nodes sent to the program. While this doesn't cause a problem for the SPT algorithm itself, it does cause a problem for the resulting shortest path list of nodes. The CB uses an unsigned 8-bit integer to store the total number of nodes in the SPT and uses this to calculate the size of a memory allocation call. If the number of nodes in the SPT overflows this integer, too little storage will be allocated creating a buffer underwrite condition.

Generic class of vulnerability

Incorrect buffer size calculation leading to a buffer underwrite

CWE classification

CWE-124 Buffer Underwrite ('Buffer Underflow') CWE-131 Incorrect Calculation of Buffer Size

Challenges

The heap-based buffer underwrite allows control of the linked-list of edges that have been sent to the CB. By controlling the list's pointers, it's possible to cause a block of stack memory to be placed on the list of free blocks for later reallocation. Then, when that next allocation occurs, data is written to the stack allowing overwrite of critical stack contents including the return address of main().

The difficulty in setting up this sequence of events is with the lookaside table used by the library malloc function. In order to be sure the correct block of previously free'd memory is used for the subsequent allocation, the size of the freed block must be carefully controlled. And since this size is part of the heap metadata, when the fake block of stack-based memory is freed, it must have correct metadata. Fortunately, main() has a stack-based counter variable which limits the number of commands that can be sent to the CB. By sending exactly the right number of previous commands and positioning the freed block correctly, the stack-based block can be freed into the correct lookaside bucket for later re-use by the pov.

The Subjective Quantifications for this vulnerability are:

Discovering - Medium Proving - Hard Fixing - Easy

POV Information

Round Source Destination Result POV Analysis Video
17 DeepRed CodeJitsu Failed POV POV Watch
17 DeepRed CSDS Failed POV POV Watch
17 DeepRed Disekt Failed POV POV Watch
17 DeepRed ForAllSecure Failed POV POV Watch
17 DeepRed Shellphish Failed POV POV Watch
17 DeepRed TECHx Failed POV POV Watch
17 ForAllSecure CodeJitsu Failed POV POV Watch
17 ForAllSecure CSDS Failed POV POV Watch
17 ForAllSecure DeepRed Failed POV POV Watch
17 ForAllSecure Disekt Failed POV POV Watch
17 ForAllSecure Shellphish Failed POV POV Watch
17 ForAllSecure TECHx Failed POV POV Watch
18 CodeJitsu Disekt Failed POV through defenses POV Watch
18 CodeJitsu Shellphish Failed POV through defenses POV Watch
18 CSDS CodeJitsu Failed POV POV Watch
18 CSDS DeepRed Failed POV POV Watch
18 CSDS Disekt Failed POV through defenses POV Watch
18 CSDS ForAllSecure Failed POV POV Watch
18 CSDS Shellphish Failed POV through defenses POV Watch
18 DeepRed CodeJitsu Failed POV POV Watch
18 DeepRed CSDS Failed POV POV Watch
18 DeepRed Disekt Failed POV through defenses POV Watch
18 DeepRed ForAllSecure Failed POV POV Watch
18 DeepRed Shellphish Failed POV through defenses POV Watch
18 ForAllSecure CodeJitsu Failed POV POV Watch
18 ForAllSecure CSDS Failed POV POV Watch
18 ForAllSecure DeepRed Failed POV POV Watch
18 ForAllSecure Disekt Failed POV through defenses POV Watch
18 ForAllSecure Shellphish Failed POV through defenses POV Watch
19 CSDS CodeJitsu Failed POV POV Watch
19 CSDS DeepRed Failed POV POV Watch
19 CSDS Disekt Failed POV through defenses POV Watch
19 CSDS ForAllSecure Failed POV POV Watch
19 CSDS Shellphish Failed POV through defenses POV Watch
19 CSDS TECHx Failed POV through defenses POV Watch
19 DeepRed CodeJitsu Failed POV POV Watch
19 DeepRed CSDS Failed POV POV Watch
19 DeepRed Disekt Failed POV through defenses POV Watch
19 DeepRed ForAllSecure Failed POV POV Watch
19 DeepRed Shellphish Failed POV through defenses POV Watch
19 DeepRed TECHx Failed POV through defenses POV Watch
19 ForAllSecure CodeJitsu Failed POV POV Watch
19 ForAllSecure CSDS Failed POV POV Watch
19 ForAllSecure DeepRed Failed POV POV Watch
19 ForAllSecure Disekt Failed POV through defenses POV Watch
19 ForAllSecure Shellphish Failed POV through defenses POV Watch
19 ForAllSecure TECHx Failed POV through defenses POV Watch
20 CSDS CodeJitsu Failed POV POV Watch
20 CSDS DeepRed Failed POV POV Watch
20 CSDS Disekt Failed POV through defenses POV Watch
20 CSDS ForAllSecure Failed POV POV Watch
20 CSDS Shellphish Failed POV through defenses POV Watch
20 CSDS TECHx Failed POV through defenses POV Watch
20 DeepRed CodeJitsu Failed POV POV Watch
20 DeepRed CSDS Failed POV POV Watch
20 DeepRed Disekt Failed POV through defenses POV Watch
20 DeepRed ForAllSecure Failed POV POV Watch
20 DeepRed Shellphish Failed POV through defenses POV Watch
20 DeepRed TECHx Failed POV through defenses POV Watch
20 ForAllSecure CodeJitsu Failed POV POV Watch
20 ForAllSecure CSDS Failed POV POV Watch
20 ForAllSecure DeepRed Failed POV POV Watch
20 ForAllSecure Disekt Failed POV through defenses POV Watch
20 ForAllSecure Shellphish Failed POV through defenses POV Watch
20 ForAllSecure TECHx Failed POV through defenses POV Watch
21 CSDS CodeJitsu Failed POV POV Watch
21 CSDS DeepRed Failed POV POV Watch
21 CSDS Disekt Failed POV through defenses POV Watch
21 CSDS ForAllSecure Failed POV POV Watch
21 CSDS Shellphish Failed POV through defenses POV Watch
21 CSDS TECHx Failed POV through defenses POV Watch
21 DeepRed CodeJitsu Failed POV POV Watch
21 DeepRed CSDS Failed POV POV Watch
21 DeepRed Disekt Failed POV through defenses POV Watch
21 DeepRed ForAllSecure Failed POV POV Watch
21 DeepRed Shellphish Failed POV through defenses POV Watch
21 DeepRed TECHx Failed POV through defenses POV Watch
21 ForAllSecure CodeJitsu Failed POV POV Watch
21 ForAllSecure CSDS Failed POV POV Watch
21 ForAllSecure DeepRed Failed POV POV Watch
21 ForAllSecure Disekt Failed POV through defenses POV Watch
21 ForAllSecure Shellphish Failed POV through defenses POV Watch
21 ForAllSecure TECHx Failed POV through defenses POV Watch
22 DeepRed CodeJitsu Failed POV POV Watch
22 DeepRed CSDS Failed POV POV Watch
22 DeepRed Disekt Failed POV through defenses POV Watch
22 DeepRed ForAllSecure Failed POV POV Watch
22 DeepRed Shellphish Failed POV through defenses POV Watch
22 DeepRed TECHx Failed POV through defenses POV Watch
22 ForAllSecure CodeJitsu Failed POV POV Watch
22 ForAllSecure CSDS Failed POV POV Watch
22 ForAllSecure DeepRed Failed POV POV Watch
22 ForAllSecure Disekt Failed POV through defenses POV Watch
22 ForAllSecure Shellphish Failed POV through defenses POV Watch
22 ForAllSecure TECHx Failed POV through defenses POV Watch
23 CSDS CodeJitsu Failed POV POV Watch
23 CSDS DeepRed Failed POV POV Watch
23 CSDS Disekt Failed POV through defenses POV Watch
23 CSDS ForAllSecure Failed POV POV Watch
23 CSDS Shellphish Failed POV through defenses POV Watch
23 CSDS TECHx Failed POV through defenses POV Watch
23 DeepRed CodeJitsu Failed POV POV Watch
23 DeepRed CSDS Failed POV POV Watch
23 DeepRed Disekt Failed POV through defenses POV Watch
23 DeepRed ForAllSecure Failed POV POV Watch
23 DeepRed Shellphish Failed POV through defenses POV Watch
23 DeepRed TECHx Failed POV through defenses POV Watch
23 ForAllSecure CodeJitsu Failed POV POV Watch
23 ForAllSecure CSDS Failed POV POV Watch
23 ForAllSecure DeepRed Failed POV POV Watch
23 ForAllSecure Disekt Failed POV through defenses POV Watch
23 ForAllSecure Shellphish Failed POV through defenses POV Watch
23 ForAllSecure TECHx Failed POV through defenses POV Watch
24 CSDS CodeJitsu Failed POV POV Watch
24 CSDS DeepRed Failed POV POV Watch
24 CSDS Disekt Failed POV through defenses POV Watch
24 CSDS ForAllSecure Failed POV POV Watch
24 CSDS Shellphish Failed POV through defenses POV Watch
24 CSDS TECHx Failed POV through defenses POV Watch
24 DeepRed CodeJitsu Failed POV POV Watch
24 DeepRed CSDS Failed POV POV Watch
24 DeepRed Disekt Failed POV through defenses POV Watch
24 DeepRed ForAllSecure Failed POV POV Watch
24 DeepRed Shellphish Failed POV through defenses POV Watch
24 DeepRed TECHx Failed POV through defenses POV Watch
24 ForAllSecure CodeJitsu Failed POV POV Watch
24 ForAllSecure CSDS Failed POV POV Watch
24 ForAllSecure DeepRed Failed POV POV Watch
24 ForAllSecure Disekt Failed POV through defenses POV Watch
24 ForAllSecure Shellphish Failed POV through defenses POV Watch
24 ForAllSecure TECHx Failed POV through defenses POV Watch
25 CSDS CodeJitsu Failed POV POV Watch
25 CSDS DeepRed Failed POV POV Watch
25 CSDS Disekt Failed POV through defenses POV Watch
25 CSDS ForAllSecure Failed POV POV Watch
25 CSDS Shellphish Failed POV through defenses POV Watch
25 CSDS TECHx Failed POV through defenses POV Watch
25 DeepRed CodeJitsu Failed POV POV Watch
25 DeepRed CSDS Failed POV POV Watch
25 DeepRed Disekt Failed POV through defenses POV Watch
25 DeepRed ForAllSecure Failed POV POV Watch
25 DeepRed Shellphish Failed POV through defenses POV Watch
25 DeepRed TECHx Failed POV through defenses POV Watch
25 ForAllSecure CodeJitsu Failed POV POV Watch
25 ForAllSecure CSDS Failed POV POV Watch
25 ForAllSecure DeepRed Failed POV POV Watch
25 ForAllSecure Disekt Failed POV through defenses POV Watch
25 ForAllSecure Shellphish Failed POV through defenses POV Watch
25 ForAllSecure TECHx Failed POV through defenses POV Watch
26 CSDS CodeJitsu Failed POV POV Watch
26 CSDS DeepRed Failed POV POV Watch
26 CSDS Disekt Failed POV through defenses POV Watch
26 CSDS ForAllSecure Failed POV POV Watch
26 CSDS Shellphish Failed POV through defenses POV Watch
26 CSDS TECHx Failed POV through defenses POV Watch
26 DeepRed CodeJitsu Failed POV POV Watch
26 DeepRed CSDS Failed POV POV Watch
26 DeepRed Disekt Failed POV through defenses POV Watch
26 DeepRed ForAllSecure Failed POV POV Watch
26 DeepRed Shellphish Failed POV through defenses POV Watch
26 DeepRed TECHx Failed POV through defenses POV Watch
26 ForAllSecure CodeJitsu Failed POV POV Watch
26 ForAllSecure CSDS Failed POV POV Watch
26 ForAllSecure DeepRed Failed POV POV Watch
26 ForAllSecure Disekt Failed POV through defenses POV Watch
26 ForAllSecure Shellphish Failed POV through defenses POV Watch
26 ForAllSecure TECHx Failed POV through defenses POV Watch
27 CSDS CodeJitsu Failed POV POV Watch
27 CSDS DeepRed Failed POV POV Watch
27 CSDS Disekt Failed POV through defenses POV Watch
27 CSDS ForAllSecure Failed POV POV Watch
27 CSDS Shellphish Failed POV through defenses POV Watch
27 CSDS TECHx Failed POV through defenses POV Watch
27 DeepRed CodeJitsu Failed POV POV Watch
27 DeepRed CSDS Failed POV POV Watch
27 DeepRed Disekt Failed POV through defenses POV Watch
27 DeepRed ForAllSecure Failed POV POV Watch
27 DeepRed Shellphish Failed POV through defenses POV Watch
27 DeepRed TECHx Failed POV through defenses POV Watch
27 ForAllSecure CodeJitsu Failed POV POV Watch
27 ForAllSecure CSDS Failed POV POV Watch
27 ForAllSecure DeepRed Failed POV POV Watch
27 ForAllSecure Disekt Failed POV through defenses POV Watch
27 ForAllSecure Shellphish Failed POV through defenses POV Watch
27 ForAllSecure TECHx Failed POV through defenses POV Watch
28 CSDS CodeJitsu Failed POV POV Watch
28 CSDS DeepRed Failed POV POV Watch
28 CSDS Disekt Failed POV through defenses POV Watch
28 CSDS ForAllSecure Failed POV POV Watch
28 CSDS Shellphish Failed POV through defenses POV Watch
28 CSDS TECHx Failed POV through defenses POV Watch
28 DeepRed CodeJitsu Failed POV POV Watch
28 DeepRed CSDS Failed POV POV Watch
28 DeepRed Disekt Failed POV through defenses POV Watch
28 DeepRed ForAllSecure Failed POV POV Watch
28 DeepRed Shellphish Failed POV through defenses POV Watch
28 DeepRed TECHx Failed POV through defenses POV Watch
28 ForAllSecure CodeJitsu Failed POV POV Watch
28 ForAllSecure CSDS Failed POV POV Watch
28 ForAllSecure DeepRed Failed POV POV Watch
28 ForAllSecure Disekt Failed POV through defenses POV Watch
28 ForAllSecure Shellphish Failed POV through defenses POV Watch
28 ForAllSecure TECHx Failed POV through defenses POV Watch
29 CSDS CodeJitsu Failed POV POV Watch
29 CSDS DeepRed Failed POV POV Watch
29 CSDS Disekt Failed POV through defenses POV Watch
29 CSDS ForAllSecure Failed POV POV Watch
29 CSDS Shellphish Failed POV through defenses POV Watch
29 CSDS TECHx Failed POV through defenses POV Watch
29 DeepRed CodeJitsu Failed POV POV Watch
29 DeepRed CSDS Failed POV POV Watch
29 DeepRed Disekt Failed POV through defenses POV Watch
29 DeepRed ForAllSecure Failed POV POV Watch
29 DeepRed Shellphish Failed POV through defenses POV Watch
29 DeepRed TECHx Failed POV through defenses POV Watch
29 ForAllSecure CodeJitsu Failed POV POV Watch
29 ForAllSecure CSDS Failed POV POV Watch
29 ForAllSecure DeepRed Failed POV POV Watch
29 ForAllSecure Disekt Failed POV through defenses POV Watch
29 ForAllSecure Shellphish Failed POV through defenses POV Watch
29 ForAllSecure TECHx Failed POV through defenses POV Watch
30 CSDS CodeJitsu Failed POV POV Watch
30 CSDS DeepRed Failed POV POV Watch
30 CSDS Disekt Failed POV through defenses POV Watch
30 CSDS ForAllSecure Failed POV POV Watch
30 CSDS Shellphish Failed POV through defenses POV Watch
30 CSDS TECHx Failed POV through defenses POV Watch
30 DeepRed CodeJitsu Failed POV POV Watch
30 DeepRed CSDS Failed POV POV Watch
30 DeepRed Disekt Failed POV through defenses POV Watch
30 DeepRed ForAllSecure Failed POV POV Watch
30 DeepRed Shellphish Failed POV through defenses POV Watch
30 DeepRed TECHx Failed POV through defenses POV Watch
30 ForAllSecure CodeJitsu Failed POV POV Watch
30 ForAllSecure CSDS Failed POV POV Watch
30 ForAllSecure DeepRed Failed POV POV Watch
30 ForAllSecure Disekt Failed POV through defenses POV Watch
30 ForAllSecure Shellphish Failed POV through defenses POV Watch
30 ForAllSecure TECHx Failed POV through defenses POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email