Challenge Information - CROMU_00077

Commonly known as: Network_File_System_v3


Rounds Enabled

71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95

Details

Original Versions

Known Vulnerabilities

  • CWE-127 - Buffer Under-read
  • CWE-196 - Unsigned to Signed Conversion Error
  • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

None

Author Information

"Jason Williams" jdw@cromulence.com

DARPA performer group

Cromulence LLC (CROMU)

Description

This service is a reimplementation of a previous network file system. This version uses C++ and a completely rewritten file system that instead of being inode based uses a database storage backend method consisting of C++ classes and linked lists. All the same features are supported including the ability to login/logout, read/write, open, close, rename, and delete a file. These commands are provided via a custom binary protocol that allows a user to perform these actions against the file system on up to 10 files. Directory support is not supported however read/write permissions and file owner are supported in this service. Entropy from the magic page is added to the service by generating the unix timestamps for file creation via a generator function and magic page data.

Feature List

This service features a binary protocol with 7 available commands: These are Login, Directory, Read, Write, Write Append, Delete and Rename. These commands operate on a back-end database file system that allows up to 10 maximum files to be written. Each file can be up to 1MB in size. Files are stored in a linked list of nodes. The Login command takes a username and password and allows the user to access the network file system and send the remaining commands. Directory provides a directory listing of files on the file system including name, creation timestamp, file size, owner, and file permissions. Read allows the user to read from a file at a specific offset and length. Write allows a user to write to the file with a specific length (and will create a new file if one does not already exist). Write append allows the user to append data to the end of the file. Delete will delete an existing file and takes a file name. Rename allows the user to rename a file on the file system to a new name.

Vulnerability

The vulnerability in this service is a type 2 POV out of bounds array access. Due to an unsigned to signed integer conversion error it is possible to cause an array access to occur on an extremely large value. This will result in an integer wrap-around of the array access and allow the user to index memory backwards from the address of the array. It is possible to point the array to a data structure in which a pointer to magic page data is present. Using the Read command and this negative value the user can read page data from the heap back (buffer under read) via the Read command and return the page data in the read response. This allows the user to report it as a type 2 vulnerability.

Generic class of vulnerability

Vulnerability 1 of 1: Unsigned to Signed Conversion Error Accessing array with negative value

CWE classification

Vulnerability 1 of 1: CWE-196: Unsigned to Signed Conversion Error CWE-127: Buffer Under-read

Challenges

Authors Subjective Challenge Difficulty: Discovering: Easy Proving: Medium Fixing: Medium

This CB has a single vulnerability present in it. It is a type 2 vulnerability and discloses magic page data. Due to the nature of the vulnerability it is relatively easy to discover a crashing input by specifying a negative value to the offset 32-bit integer for a Read command. If the value is large enough then the buffer under run reads a value outside of an allocated page resulting in SIGSEGV. The difficulty lies in directing the under read to a specific memory address that leaks page data via a pointer to magic page data on the heap. The user also then has to craft the read length to be sufficiently large that the data returned from the read request leaks enough page data back necessary for a type 2 POV.


POV Information

Round Source Destination Result POV Analysis Video
72 CSDS CodeJitsu Failed POV POV Watch
72 CSDS DeepRed Failed POV POV Watch
72 CSDS Disekt Failed POV POV Watch
72 CSDS ForAllSecure Failed POV POV Watch
72 CSDS Shellphish Failed POV POV Watch
72 CSDS TECHx Failed POV POV Watch
72 DeepRed CodeJitsu Failed POV POV Watch
72 DeepRed CSDS Failed POV POV Watch
72 DeepRed Disekt Failed POV POV Watch
72 DeepRed ForAllSecure Failed POV POV Watch
72 DeepRed Shellphish Failed POV POV Watch
72 DeepRed TECHx Failed POV POV Watch
73 CodeJitsu Disekt Failed POV through defenses POV Watch
73 CSDS CodeJitsu Failed POV POV Watch
73 CSDS DeepRed Failed POV POV Watch
73 CSDS Disekt Failed POV through defenses POV Watch
73 CSDS ForAllSecure Failed POV POV Watch
73 CSDS Shellphish Failed POV POV Watch
73 CSDS TECHx Failed POV POV Watch
73 DeepRed CodeJitsu Failed POV POV Watch
73 DeepRed CSDS Failed POV POV Watch
73 DeepRed Disekt Failed POV through defenses POV Watch
73 DeepRed ForAllSecure Failed POV POV Watch
73 DeepRed Shellphish Failed POV POV Watch
73 DeepRed TECHx Failed POV POV Watch
74 CodeJitsu Shellphish Failed POV through defenses POV Watch
74 CSDS CodeJitsu Failed POV POV Watch
74 CSDS DeepRed Failed POV POV Watch
74 CSDS Disekt Failed POV through defenses POV Watch
74 CSDS ForAllSecure Failed POV POV Watch
74 CSDS Shellphish Failed POV through defenses POV Watch
74 CSDS TECHx Failed POV POV Watch
74 DeepRed CodeJitsu Failed POV POV Watch
74 DeepRed CSDS Failed POV POV Watch
74 DeepRed Disekt Failed POV through defenses POV Watch
74 DeepRed ForAllSecure Failed POV POV Watch
74 DeepRed Shellphish Failed POV through defenses POV Watch
74 DeepRed TECHx Failed POV POV Watch
75 CSDS CodeJitsu Failed POV POV Watch
75 CSDS DeepRed Failed POV POV Watch
75 CSDS Disekt Failed POV through defenses POV Watch
75 CSDS ForAllSecure Failed POV POV Watch
75 CSDS Shellphish Failed POV through defenses POV Watch
75 CSDS TECHx Failed POV POV Watch
75 DeepRed CodeJitsu Failed POV POV Watch
75 DeepRed CSDS Failed POV POV Watch
75 DeepRed Disekt Failed POV through defenses POV Watch
75 DeepRed ForAllSecure Failed POV POV Watch
75 DeepRed Shellphish Failed POV through defenses POV Watch
75 DeepRed TECHx Failed POV POV Watch
76 CSDS CodeJitsu Failed POV POV Watch
76 CSDS DeepRed Failed POV POV Watch
76 CSDS Disekt Failed POV through defenses POV Watch
76 CSDS ForAllSecure Failed POV POV Watch
76 CSDS Shellphish Failed POV through defenses POV Watch
76 CSDS TECHx Failed POV POV Watch
76 DeepRed CodeJitsu Failed POV POV Watch
76 DeepRed CSDS Failed POV POV Watch
76 DeepRed Disekt Failed POV through defenses POV Watch
76 DeepRed ForAllSecure Failed POV POV Watch
76 DeepRed Shellphish Failed POV through defenses POV Watch
76 DeepRed TECHx Failed POV POV Watch
77 CSDS CodeJitsu Failed POV POV Watch
77 CSDS DeepRed Failed POV POV Watch
77 CSDS Disekt Failed POV through defenses POV Watch
77 CSDS ForAllSecure Failed POV POV Watch
77 CSDS Shellphish Failed POV through defenses POV Watch
77 CSDS TECHx Failed POV POV Watch
77 DeepRed CodeJitsu Failed POV POV Watch
77 DeepRed CSDS Failed POV POV Watch
77 DeepRed Disekt Failed POV through defenses POV Watch
77 DeepRed ForAllSecure Failed POV POV Watch
77 DeepRed Shellphish Failed POV through defenses POV Watch
77 DeepRed TECHx Failed POV POV Watch
78 CSDS CodeJitsu Failed POV POV Watch
78 CSDS DeepRed Failed POV POV Watch
78 CSDS Disekt Failed POV through defenses POV Watch
78 CSDS ForAllSecure Failed POV POV Watch
78 CSDS Shellphish Failed POV through defenses POV Watch
78 CSDS TECHx Failed POV POV Watch
78 DeepRed CodeJitsu Failed POV POV Watch
78 DeepRed CSDS Failed POV POV Watch
78 DeepRed Disekt Failed POV through defenses POV Watch
78 DeepRed ForAllSecure Failed POV POV Watch
78 DeepRed Shellphish Failed POV through defenses POV Watch
78 DeepRed TECHx Failed POV POV Watch
79 CSDS CodeJitsu Failed POV POV Watch
79 CSDS DeepRed Failed POV POV Watch
79 CSDS Disekt Failed POV through defenses POV Watch
79 CSDS ForAllSecure Failed POV POV Watch
79 CSDS Shellphish Failed POV through defenses POV Watch
79 CSDS TECHx Failed POV POV Watch
79 DeepRed CodeJitsu Failed POV POV Watch
79 DeepRed CSDS Failed POV POV Watch
79 DeepRed Disekt Failed POV through defenses POV Watch
79 DeepRed ForAllSecure Failed POV POV Watch
79 DeepRed Shellphish Failed POV through defenses POV Watch
79 DeepRed TECHx Failed POV POV Watch
80 CSDS CodeJitsu Failed POV POV Watch
80 CSDS DeepRed Failed POV POV Watch
80 CSDS Disekt Failed POV through defenses POV Watch
80 CSDS ForAllSecure Failed POV POV Watch
80 CSDS Shellphish Failed POV through defenses POV Watch
80 CSDS TECHx Failed POV POV Watch
80 DeepRed CodeJitsu Failed POV POV Watch
80 DeepRed CSDS Failed POV POV Watch
80 DeepRed Disekt Failed POV through defenses POV Watch
80 DeepRed ForAllSecure Failed POV POV Watch
80 DeepRed Shellphish Failed POV through defenses POV Watch
80 DeepRed TECHx Failed POV POV Watch
81 CSDS CodeJitsu Failed POV POV Watch
81 CSDS DeepRed Failed POV POV Watch
81 CSDS Disekt Failed POV through defenses POV Watch
81 CSDS ForAllSecure Failed POV POV Watch
81 CSDS Shellphish Failed POV through defenses POV Watch
81 CSDS TECHx Failed POV POV Watch
81 DeepRed CodeJitsu Failed POV POV Watch
81 DeepRed CSDS Failed POV POV Watch
81 DeepRed Disekt Failed POV through defenses POV Watch
81 DeepRed ForAllSecure Failed POV POV Watch
81 DeepRed Shellphish Failed POV through defenses POV Watch
81 DeepRed TECHx Failed POV POV Watch
82 CSDS CodeJitsu Failed POV POV Watch
82 CSDS DeepRed Failed POV POV Watch
82 CSDS Disekt Failed POV through defenses POV Watch
82 CSDS ForAllSecure Failed POV POV Watch
82 CSDS Shellphish Failed POV through defenses POV Watch
82 CSDS TECHx Failed POV POV Watch
82 DeepRed CodeJitsu Failed POV POV Watch
82 DeepRed CSDS Failed POV POV Watch
82 DeepRed Disekt Failed POV through defenses POV Watch
82 DeepRed ForAllSecure Failed POV POV Watch
82 DeepRed Shellphish Failed POV through defenses POV Watch
82 DeepRed TECHx Failed POV POV Watch
83 CSDS CodeJitsu Failed POV POV Watch
83 CSDS DeepRed Failed POV POV Watch
83 CSDS Disekt Failed POV through defenses POV Watch
83 CSDS ForAllSecure Failed POV POV Watch
83 CSDS Shellphish Failed POV through defenses POV Watch
83 CSDS TECHx Failed POV POV Watch
83 DeepRed CodeJitsu Failed POV POV Watch
83 DeepRed CSDS Failed POV POV Watch
83 DeepRed Disekt Failed POV through defenses POV Watch
83 DeepRed ForAllSecure Failed POV POV Watch
83 DeepRed Shellphish Failed POV through defenses POV Watch
83 DeepRed TECHx Failed POV POV Watch
84 CSDS CodeJitsu Failed POV POV Watch
84 CSDS DeepRed Failed POV POV Watch
84 CSDS Disekt Failed POV through defenses POV Watch
84 CSDS ForAllSecure Failed POV POV Watch
84 CSDS Shellphish Failed POV through defenses POV Watch
84 CSDS TECHx Failed POV POV Watch
84 DeepRed CodeJitsu Failed POV POV Watch
84 DeepRed CSDS Failed POV POV Watch
84 DeepRed Disekt Failed POV through defenses POV Watch
84 DeepRed ForAllSecure Failed POV POV Watch
84 DeepRed Shellphish Failed POV through defenses POV Watch
84 DeepRed TECHx Failed POV POV Watch
85 CSDS CodeJitsu Failed POV POV Watch
85 CSDS DeepRed Failed POV POV Watch
85 CSDS Disekt Failed POV through defenses POV Watch
85 CSDS ForAllSecure Failed POV POV Watch
85 CSDS Shellphish Failed POV through defenses POV Watch
85 CSDS TECHx Failed POV POV Watch
85 DeepRed CodeJitsu Failed POV POV Watch
85 DeepRed CSDS Failed POV POV Watch
85 DeepRed Disekt Failed POV through defenses POV Watch
85 DeepRed ForAllSecure Failed POV POV Watch
85 DeepRed Shellphish Failed POV through defenses POV Watch
85 DeepRed TECHx Failed POV POV Watch
86 CSDS CodeJitsu Failed POV POV Watch
86 CSDS DeepRed Failed POV POV Watch
86 CSDS Disekt Failed POV through defenses POV Watch
86 CSDS ForAllSecure Failed POV POV Watch
86 CSDS Shellphish Failed POV through defenses POV Watch
86 CSDS TECHx Failed POV POV Watch
86 DeepRed CodeJitsu Failed POV POV Watch
86 DeepRed CSDS Failed POV POV Watch
86 DeepRed Disekt Failed POV through defenses POV Watch
86 DeepRed ForAllSecure Failed POV POV Watch
86 DeepRed Shellphish Failed POV through defenses POV Watch
86 DeepRed TECHx Failed POV POV Watch
87 CSDS CodeJitsu Failed POV POV Watch
87 CSDS DeepRed Failed POV POV Watch
87 CSDS Disekt Failed POV through defenses POV Watch
87 CSDS ForAllSecure Failed POV POV Watch
87 CSDS Shellphish Failed POV through defenses POV Watch
87 CSDS TECHx Failed POV POV Watch
87 DeepRed CodeJitsu Failed POV POV Watch
87 DeepRed CSDS Failed POV POV Watch
87 DeepRed Disekt Failed POV through defenses POV Watch
87 DeepRed ForAllSecure Failed POV POV Watch
87 DeepRed Shellphish Failed POV through defenses POV Watch
87 DeepRed TECHx Failed POV POV Watch
88 CSDS CodeJitsu Failed POV POV Watch
88 CSDS DeepRed Failed POV POV Watch
88 CSDS Disekt Failed POV through defenses POV Watch
88 CSDS ForAllSecure Failed POV POV Watch
88 CSDS Shellphish Failed POV through defenses POV Watch
88 CSDS TECHx Failed POV POV Watch
88 DeepRed CodeJitsu Failed POV POV Watch
88 DeepRed CSDS Failed POV POV Watch
88 DeepRed Disekt Failed POV through defenses POV Watch
88 DeepRed ForAllSecure Failed POV POV Watch
88 DeepRed Shellphish Failed POV through defenses POV Watch
88 DeepRed TECHx Failed POV POV Watch
89 CSDS CodeJitsu Failed POV POV Watch
89 CSDS DeepRed Failed POV POV Watch
89 CSDS Disekt Failed POV through defenses POV Watch
89 CSDS ForAllSecure Failed POV POV Watch
89 CSDS Shellphish Failed POV through defenses POV Watch
89 CSDS TECHx Failed POV POV Watch
89 DeepRed CodeJitsu Failed POV POV Watch
89 DeepRed CSDS Failed POV POV Watch
89 DeepRed Disekt Failed POV through defenses POV Watch
89 DeepRed ForAllSecure Failed POV POV Watch
89 DeepRed Shellphish Failed POV through defenses POV Watch
89 DeepRed TECHx Failed POV POV Watch
90 CSDS CodeJitsu Failed POV POV Watch
90 CSDS DeepRed Failed POV POV Watch
90 CSDS Disekt Failed POV through defenses POV Watch
90 CSDS ForAllSecure Failed POV POV Watch
90 CSDS Shellphish Failed POV through defenses POV Watch
90 CSDS TECHx Failed POV POV Watch
90 DeepRed CodeJitsu Failed POV POV Watch
90 DeepRed CSDS Failed POV POV Watch
90 DeepRed Disekt Failed POV through defenses POV Watch
90 DeepRed ForAllSecure Failed POV POV Watch
90 DeepRed Shellphish Failed POV through defenses POV Watch
90 DeepRed TECHx Failed POV POV Watch
91 CSDS CodeJitsu Failed POV POV Watch
91 CSDS DeepRed Failed POV POV Watch
91 CSDS Disekt Failed POV through defenses POV Watch
91 CSDS ForAllSecure Failed POV POV Watch
91 CSDS Shellphish Failed POV through defenses POV Watch
91 CSDS TECHx Failed POV POV Watch
91 DeepRed CodeJitsu Failed POV POV Watch
91 DeepRed CSDS Failed POV POV Watch
91 DeepRed Disekt Failed POV through defenses POV Watch
91 DeepRed ForAllSecure Failed POV POV Watch
91 DeepRed Shellphish Failed POV through defenses POV Watch
91 DeepRed TECHx Failed POV POV Watch
91 ForAllSecure CodeJitsu Failed POV POV Watch
91 ForAllSecure CSDS Failed POV POV Watch
91 ForAllSecure DeepRed Failed POV POV Watch
91 ForAllSecure Disekt Failed POV through defenses POV Watch
91 ForAllSecure Shellphish Failed POV through defenses POV Watch
91 ForAllSecure TECHx Failed POV POV Watch
92 CSDS CodeJitsu Failed POV POV Watch
92 CSDS DeepRed Failed POV POV Watch
92 CSDS Disekt Failed POV through defenses POV Watch
92 CSDS ForAllSecure Failed POV POV Watch
92 CSDS Shellphish Failed POV through defenses POV Watch
92 CSDS TECHx Failed POV POV Watch
92 DeepRed CodeJitsu Failed POV POV Watch
92 DeepRed CSDS Failed POV POV Watch
92 DeepRed Disekt Failed POV through defenses POV Watch
92 DeepRed ForAllSecure Failed POV POV Watch
92 DeepRed Shellphish Failed POV through defenses POV Watch
92 DeepRed TECHx Failed POV POV Watch
92 ForAllSecure CodeJitsu Failed POV POV Watch
92 ForAllSecure CSDS Failed POV POV Watch
92 ForAllSecure DeepRed Failed POV POV Watch
92 ForAllSecure Disekt Failed POV through defenses POV Watch
92 ForAllSecure Shellphish Failed POV through defenses POV Watch
92 ForAllSecure TECHx Failed POV POV Watch
93 CSDS CodeJitsu Failed POV POV Watch
93 CSDS DeepRed Failed POV POV Watch
93 CSDS Disekt Failed POV through defenses POV Watch
93 CSDS ForAllSecure Failed POV POV Watch
93 CSDS Shellphish Failed POV through defenses POV Watch
93 CSDS TECHx Failed POV POV Watch
93 DeepRed CodeJitsu Failed POV POV Watch
93 DeepRed CSDS Failed POV POV Watch
93 DeepRed Disekt Failed POV through defenses POV Watch
93 DeepRed ForAllSecure Failed POV POV Watch
93 DeepRed Shellphish Failed POV through defenses POV Watch
93 DeepRed TECHx Failed POV POV Watch
93 ForAllSecure CodeJitsu Failed POV POV Watch
93 ForAllSecure CSDS Failed POV POV Watch
93 ForAllSecure DeepRed Failed POV POV Watch
93 ForAllSecure Disekt Failed POV through defenses POV Watch
93 ForAllSecure Shellphish Failed POV through defenses POV Watch
93 ForAllSecure TECHx Failed POV POV Watch
94 CSDS CodeJitsu Failed POV POV Watch
94 CSDS DeepRed Failed POV POV Watch
94 CSDS Disekt Failed POV through defenses POV Watch
94 CSDS ForAllSecure Failed POV POV Watch
94 CSDS Shellphish Failed POV through defenses POV Watch
94 CSDS TECHx Failed POV POV Watch
94 DeepRed CodeJitsu Failed POV POV Watch
94 DeepRed CSDS Failed POV POV Watch
94 DeepRed Disekt Failed POV through defenses POV Watch
94 DeepRed ForAllSecure Failed POV POV Watch
94 DeepRed Shellphish Failed POV through defenses POV Watch
94 DeepRed TECHx Failed POV POV Watch
94 ForAllSecure CodeJitsu Failed POV POV Watch
94 ForAllSecure CSDS Failed POV POV Watch
94 ForAllSecure DeepRed Failed POV POV Watch
94 ForAllSecure Disekt Failed POV through defenses POV Watch
94 ForAllSecure Shellphish Failed POV through defenses POV Watch
94 ForAllSecure TECHx Failed POV POV Watch
95 CSDS CodeJitsu Failed POV POV Watch
95 CSDS DeepRed Failed POV POV Watch
95 CSDS Disekt Failed POV through defenses POV Watch
95 CSDS ForAllSecure Failed POV POV Watch
95 CSDS Shellphish Failed POV through defenses POV Watch
95 CSDS TECHx Failed POV POV Watch
95 DeepRed CodeJitsu Failed POV POV Watch
95 DeepRed CSDS Failed POV POV Watch
95 DeepRed Disekt Failed POV through defenses POV Watch
95 DeepRed ForAllSecure Failed POV POV Watch
95 DeepRed Shellphish Failed POV through defenses POV Watch
95 DeepRed TECHx Failed POV POV Watch
95 ForAllSecure CodeJitsu Failed POV POV Watch
95 ForAllSecure CSDS Failed POV POV Watch
95 ForAllSecure DeepRed Failed POV POV Watch
95 ForAllSecure Disekt Failed POV through defenses POV Watch
95 ForAllSecure Shellphish Failed POV through defenses POV Watch
95 ForAllSecure TECHx Failed POV POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email