Challenge Information - CROMU_00078

Commonly known as: 3D_Image_Toolkit

Rounds Enabled

74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95

Details

Original Versions

Known Vulnerabilities

  • CWE-125 - Out-of-bounds Read
    • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

Author Information

"Dan Czarnecki" cgc@cromulence.com

DARPA performer group

Cromulence (CROMU)

Description

This service implements a toolkit for a custom 3D image format. The format consists of a sequence of bytes that make up the X, Y, Z coordinates and the Red (R), Green (G), Blue (B), and Alpha (A) color values for each pixel in the image.

There are commands available to the user that alter the 3DC image data within the service that allow the image to be manipulated in a multitude of ways.

Feature List

The user can access the following commands:

  • Create a new file from user-provided data
  • View the data for every pixel in the image at once
  • View the data for a single user-selected pixel
  • Skew the X, Y, or Z coordinates of the pixels by a user-provided value
  • Rotate the entire image about the X, Y, or Z axis by a user-provided degree value
  • Scale the entire image by a user-provided value
  • Alter the brightness of the image by a user-provided value
  • Change the opacity of the image by a user-provided value
  • Compress the image by turning the RGB color values for each pixel into an 8-bit representation
  • Decompress the compressed image data back into the active image data, not without losing color data due to the compression
  • Exit the toolkit

Vulnerability

The user has an option to compress and decompress the image data, as well as show individual pixels. If the user provides a pixel index that is out of range, they are told that it was out of range, and they are presented the data for the last pixel that was printed. When the compress command is selected, the compressed data is written to a variable on the main stack that is the valid size of the image data when it is compressed. However, when the decompress command is selected, the same variable is used for the decompressed data copy. The size of the decompressed data is obviously larger, and therefore this writes data outside of the boundary and into other variables on the stack, one of which is the pointer to the last shown pixel.

With this, the user can provide new image data that contains the address of the region of memory with magic page data, compress the image, decompress it, and then run the command to show an individual pixel's data. The pixel index must be out of the range, so that it pulls from the pointer to the last shown pixel, which now holds a pointer to the magic page data (if the new image data was properly crafted). This results in pixel image data in decimal X, Y, and Z coordinates, as well as hexadecimal RGBA values.

Generic class of vulnerability

Out of bounds read

CWE classification

CWE-125: Out-of-bounds read

Challenges

The first challenge for the CRS is to understand the toolkit menu interface and craft proper data to send to the CB in order to properly initiate commands to alter the image data.

For this vulnerability, the CRS must understand how to create a new image file, submit the correct length of data to the CB, and find the bug which allows for manipulation of the newly crafted image data in a certain sequence that can lead to leaking data from the magic page.

The Subjective Quantifications for this vulnerability are:

Discovering - Medium Proving - Easy Fixing - Easy

POV Information

Round Source Destination Result POV Analysis Video
75 CSDS CodeJitsu Failed POV POV Watch
75 CSDS DeepRed Failed POV POV Watch
75 CSDS Disekt Failed POV POV Watch
75 CSDS ForAllSecure Failed POV POV Watch
75 CSDS Shellphish Failed POV POV Watch
75 CSDS TECHx Failed POV POV Watch
75 DeepRed CodeJitsu Failed POV POV Watch
75 DeepRed CSDS Failed POV POV Watch
75 DeepRed Disekt Failed POV POV Watch
75 DeepRed ForAllSecure Failed POV POV Watch
75 DeepRed Shellphish Failed POV POV Watch
75 DeepRed TECHx Failed POV POV Watch
76 CSDS CodeJitsu Failed POV POV Watch
76 CSDS DeepRed Failed POV POV Watch
76 CSDS Disekt Failed POV POV Watch
76 CSDS ForAllSecure Failed POV POV Watch
76 CSDS Shellphish Failed POV POV Watch
76 DeepRed CodeJitsu Failed POV POV Watch
76 DeepRed CSDS Failed POV POV Watch
76 DeepRed Disekt Failed POV POV Watch
76 DeepRed ForAllSecure Failed POV POV Watch
76 DeepRed Shellphish Failed POV POV Watch
77 CSDS CodeJitsu Failed POV POV Watch
77 CSDS DeepRed Failed POV POV Watch
77 CSDS Disekt Failed POV POV Watch
77 CSDS ForAllSecure Failed POV POV Watch
77 CSDS Shellphish Failed POV POV Watch
77 CSDS TECHx Failed POV through defenses POV Watch
77 DeepRed CodeJitsu Failed POV POV Watch
77 DeepRed CSDS Failed POV POV Watch
77 DeepRed Disekt Failed POV POV Watch
77 DeepRed ForAllSecure Failed POV POV Watch
77 DeepRed Shellphish Failed POV POV Watch
77 DeepRed TECHx Failed POV through defenses POV Watch
78 CSDS CodeJitsu Failed POV POV Watch
78 CSDS DeepRed Failed POV POV Watch
78 CSDS Disekt Failed POV POV Watch
78 CSDS ForAllSecure Failed POV POV Watch
78 CSDS Shellphish Failed POV POV Watch
78 CSDS TECHx Failed POV through defenses POV Watch
78 DeepRed CodeJitsu Failed POV POV Watch
78 DeepRed CSDS Failed POV POV Watch
78 DeepRed Disekt Failed POV POV Watch
78 DeepRed ForAllSecure Failed POV POV Watch
78 DeepRed Shellphish Failed POV POV Watch
78 DeepRed TECHx Failed POV through defenses POV Watch
79 CodeJitsu Disekt Failed POV through defenses POV Watch
79 CSDS CodeJitsu Failed POV POV Watch
79 CSDS DeepRed Failed POV POV Watch
79 CSDS Disekt Failed POV through defenses POV Watch
79 CSDS ForAllSecure Failed POV POV Watch
79 CSDS Shellphish Failed POV POV Watch
79 CSDS TECHx Failed POV through defenses POV Watch
79 DeepRed CodeJitsu Failed POV POV Watch
79 DeepRed CSDS Failed POV POV Watch
79 DeepRed Disekt Failed POV through defenses POV Watch
79 DeepRed ForAllSecure Failed POV POV Watch
79 DeepRed Shellphish Failed POV POV Watch
79 DeepRed TECHx Failed POV through defenses POV Watch
80 CSDS CodeJitsu Failed POV POV Watch
80 CSDS DeepRed Failed POV POV Watch
80 CSDS Disekt Failed POV through defenses POV Watch
80 CSDS ForAllSecure Failed POV POV Watch
80 CSDS Shellphish Failed POV POV Watch
80 CSDS TECHx Failed POV through defenses POV Watch
80 DeepRed CodeJitsu Failed POV POV Watch
80 DeepRed CSDS Failed POV POV Watch
80 DeepRed Disekt Failed POV through defenses POV Watch
80 DeepRed ForAllSecure Failed POV POV Watch
80 DeepRed Shellphish Failed POV POV Watch
80 DeepRed TECHx Failed POV through defenses POV Watch
81 CodeJitsu Shellphish Failed POV through defenses POV Watch
81 CSDS CodeJitsu Failed POV POV Watch
81 CSDS DeepRed Failed POV POV Watch
81 CSDS Disekt Failed POV through defenses POV Watch
81 CSDS ForAllSecure Failed POV POV Watch
81 CSDS Shellphish Failed POV through defenses POV Watch
81 CSDS TECHx Failed POV through defenses POV Watch
81 DeepRed CodeJitsu Failed POV POV Watch
81 DeepRed CSDS Failed POV POV Watch
81 DeepRed Disekt Failed POV through defenses POV Watch
81 DeepRed ForAllSecure Failed POV POV Watch
81 DeepRed Shellphish Failed POV through defenses POV Watch
81 DeepRed TECHx Failed POV through defenses POV Watch
82 CSDS CodeJitsu Failed POV POV Watch
82 CSDS DeepRed Failed POV POV Watch
82 CSDS Disekt Failed POV through defenses POV Watch
82 CSDS ForAllSecure Failed POV POV Watch
82 CSDS Shellphish Failed POV through defenses POV Watch
82 CSDS TECHx Failed POV through defenses POV Watch
82 DeepRed CodeJitsu Failed POV POV Watch
82 DeepRed CSDS Failed POV POV Watch
82 DeepRed Disekt Failed POV through defenses POV Watch
82 DeepRed ForAllSecure Failed POV POV Watch
82 DeepRed Shellphish Failed POV through defenses POV Watch
82 DeepRed TECHx Failed POV through defenses POV Watch
83 CodeJitsu TECHx Failed POV through defenses POV Watch
83 CSDS CodeJitsu Failed POV POV Watch
83 CSDS DeepRed Failed POV POV Watch
83 CSDS Disekt Failed POV through defenses POV Watch
83 CSDS ForAllSecure Failed POV POV Watch
83 CSDS Shellphish Failed POV through defenses POV Watch
83 CSDS TECHx Failed POV through defenses POV Watch
83 DeepRed CodeJitsu Failed POV POV Watch
83 DeepRed CSDS Failed POV POV Watch
83 DeepRed Disekt Failed POV through defenses POV Watch
83 DeepRed ForAllSecure Failed POV POV Watch
83 DeepRed Shellphish Failed POV through defenses POV Watch
83 DeepRed TECHx Failed POV through defenses POV Watch
84 CSDS CodeJitsu Failed POV POV Watch
84 CSDS DeepRed Failed POV POV Watch
84 CSDS Disekt Failed POV through defenses POV Watch
84 CSDS ForAllSecure Failed POV POV Watch
84 CSDS Shellphish Failed POV through defenses POV Watch
84 CSDS TECHx Failed POV through defenses POV Watch
84 DeepRed CodeJitsu Failed POV POV Watch
84 DeepRed CSDS Failed POV POV Watch
84 DeepRed Disekt Failed POV through defenses POV Watch
84 DeepRed ForAllSecure Failed POV POV Watch
84 DeepRed Shellphish Failed POV through defenses POV Watch
84 DeepRed TECHx Failed POV through defenses POV Watch
85 CSDS CodeJitsu Failed POV POV Watch
85 CSDS DeepRed Failed POV POV Watch
85 CSDS Disekt Failed POV through defenses POV Watch
85 CSDS ForAllSecure Failed POV POV Watch
85 CSDS Shellphish Failed POV through defenses POV Watch
85 CSDS TECHx Failed POV through defenses POV Watch
85 DeepRed CodeJitsu Failed POV POV Watch
85 DeepRed CSDS Failed POV POV Watch
85 DeepRed Disekt Failed POV through defenses POV Watch
85 DeepRed ForAllSecure Failed POV POV Watch
85 DeepRed Shellphish Failed POV through defenses POV Watch
85 DeepRed TECHx Failed POV through defenses POV Watch
86 CSDS CodeJitsu Failed POV POV Watch
86 CSDS DeepRed Failed POV POV Watch
86 CSDS Disekt Failed POV through defenses POV Watch
86 CSDS ForAllSecure Failed POV POV Watch
86 CSDS Shellphish Failed POV through defenses POV Watch
86 CSDS TECHx Failed POV through defenses POV Watch
86 DeepRed CodeJitsu Failed POV POV Watch
86 DeepRed CSDS Failed POV POV Watch
86 DeepRed Disekt Failed POV through defenses POV Watch
86 DeepRed ForAllSecure Failed POV POV Watch
86 DeepRed Shellphish Failed POV through defenses POV Watch
86 DeepRed TECHx Failed POV through defenses POV Watch
87 CSDS CodeJitsu Failed POV POV Watch
87 CSDS DeepRed Failed POV POV Watch
87 CSDS Disekt Failed POV through defenses POV Watch
87 CSDS ForAllSecure Failed POV POV Watch
87 CSDS Shellphish Failed POV through defenses POV Watch
87 CSDS TECHx Failed POV through defenses POV Watch
87 DeepRed CodeJitsu Failed POV POV Watch
87 DeepRed CSDS Failed POV POV Watch
87 DeepRed Disekt Failed POV through defenses POV Watch
87 DeepRed ForAllSecure Failed POV POV Watch
87 DeepRed Shellphish Failed POV through defenses POV Watch
87 DeepRed TECHx Failed POV through defenses POV Watch
88 CSDS CodeJitsu Failed POV POV Watch
88 CSDS DeepRed Failed POV POV Watch
88 CSDS Disekt Failed POV through defenses POV Watch
88 CSDS ForAllSecure Failed POV POV Watch
88 CSDS Shellphish Failed POV through defenses POV Watch
88 CSDS TECHx Failed POV through defenses POV Watch
88 DeepRed CodeJitsu Failed POV POV Watch
88 DeepRed CSDS Failed POV POV Watch
88 DeepRed Disekt Failed POV through defenses POV Watch
88 DeepRed ForAllSecure Failed POV POV Watch
88 DeepRed Shellphish Failed POV through defenses POV Watch
88 DeepRed TECHx Failed POV through defenses POV Watch
89 CSDS CodeJitsu Failed POV POV Watch
89 CSDS DeepRed Failed POV POV Watch
89 CSDS Disekt Failed POV through defenses POV Watch
89 CSDS ForAllSecure Failed POV POV Watch
89 CSDS Shellphish Failed POV through defenses POV Watch
89 CSDS TECHx Failed POV through defenses POV Watch
89 DeepRed CodeJitsu Failed POV POV Watch
89 DeepRed CSDS Failed POV POV Watch
89 DeepRed Disekt Failed POV through defenses POV Watch
89 DeepRed ForAllSecure Failed POV POV Watch
89 DeepRed Shellphish Failed POV through defenses POV Watch
89 DeepRed TECHx Failed POV through defenses POV Watch
90 CSDS CodeJitsu Failed POV POV Watch
90 CSDS DeepRed Failed POV POV Watch
90 CSDS Disekt Failed POV through defenses POV Watch
90 CSDS ForAllSecure Failed POV POV Watch
90 CSDS Shellphish Failed POV through defenses POV Watch
90 CSDS TECHx Failed POV through defenses POV Watch
90 DeepRed CodeJitsu Failed POV POV Watch
90 DeepRed CSDS Failed POV POV Watch
90 DeepRed Disekt Failed POV through defenses POV Watch
90 DeepRed ForAllSecure Failed POV POV Watch
90 DeepRed Shellphish Failed POV through defenses POV Watch
90 DeepRed TECHx Failed POV through defenses POV Watch
91 CSDS CodeJitsu Failed POV POV Watch
91 CSDS DeepRed Failed POV POV Watch
91 CSDS Disekt Failed POV through defenses POV Watch
91 CSDS ForAllSecure Failed POV POV Watch
91 CSDS Shellphish Failed POV through defenses POV Watch
91 CSDS TECHx Failed POV through defenses POV Watch
91 DeepRed CodeJitsu Failed POV POV Watch
91 DeepRed CSDS Failed POV POV Watch
91 DeepRed Disekt Failed POV through defenses POV Watch
91 DeepRed ForAllSecure Failed POV POV Watch
91 DeepRed Shellphish Failed POV through defenses POV Watch
91 DeepRed TECHx Failed POV through defenses POV Watch
92 CSDS CodeJitsu Failed POV POV Watch
92 CSDS DeepRed Failed POV POV Watch
92 CSDS Disekt Failed POV through defenses POV Watch
92 CSDS ForAllSecure Failed POV POV Watch
92 CSDS Shellphish Failed POV through defenses POV Watch
92 CSDS TECHx Failed POV through defenses POV Watch
92 DeepRed CodeJitsu Failed POV POV Watch
92 DeepRed CSDS Failed POV POV Watch
92 DeepRed Disekt Failed POV through defenses POV Watch
92 DeepRed ForAllSecure Failed POV POV Watch
92 DeepRed Shellphish Failed POV through defenses POV Watch
92 DeepRed TECHx Failed POV through defenses POV Watch
93 CSDS CodeJitsu Failed POV POV Watch
93 CSDS DeepRed Failed POV POV Watch
93 CSDS Disekt Failed POV through defenses POV Watch
93 CSDS ForAllSecure Failed POV POV Watch
93 CSDS Shellphish Failed POV through defenses POV Watch
93 CSDS TECHx Failed POV through defenses POV Watch
93 DeepRed CodeJitsu Failed POV POV Watch
93 DeepRed CSDS Failed POV POV Watch
93 DeepRed Disekt Failed POV through defenses POV Watch
93 DeepRed ForAllSecure Failed POV POV Watch
93 DeepRed Shellphish Failed POV through defenses POV Watch
93 DeepRed TECHx Failed POV through defenses POV Watch
94 CSDS CodeJitsu Failed POV POV Watch
94 CSDS DeepRed Failed POV POV Watch
94 CSDS Disekt Failed POV through defenses POV Watch
94 CSDS ForAllSecure Failed POV POV Watch
94 CSDS Shellphish Failed POV through defenses POV Watch
94 CSDS TECHx Failed POV through defenses POV Watch
94 DeepRed CodeJitsu Failed POV POV Watch
94 DeepRed CSDS Failed POV POV Watch
94 DeepRed Disekt Failed POV through defenses POV Watch
94 DeepRed ForAllSecure Failed POV POV Watch
94 DeepRed Shellphish Failed POV through defenses POV Watch
94 DeepRed TECHx Failed POV through defenses POV Watch
95 CSDS CodeJitsu Failed POV POV Watch
95 CSDS DeepRed Failed POV POV Watch
95 CSDS Disekt Failed POV through defenses POV Watch
95 CSDS ForAllSecure Failed POV POV Watch
95 CSDS Shellphish Failed POV through defenses POV Watch
95 CSDS TECHx Failed POV through defenses POV Watch
95 DeepRed CodeJitsu Failed POV POV Watch
95 DeepRed CSDS Failed POV POV Watch
95 DeepRed Disekt Failed POV through defenses POV Watch
95 DeepRed ForAllSecure Failed POV POV Watch
95 DeepRed Shellphish Failed POV through defenses POV Watch
95 DeepRed TECHx Failed POV through defenses POV Watch
95 ForAllSecure CodeJitsu Failed POV POV Watch
95 ForAllSecure CSDS Failed POV POV Watch
95 ForAllSecure DeepRed Failed POV POV Watch
95 ForAllSecure Disekt Failed POV through defenses POV Watch
95 ForAllSecure Shellphish Failed POV through defenses POV Watch
95 ForAllSecure TECHx Failed POV through defenses POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email