Rounds Enabled

75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95

Details

• POV Information

Original Versions

• Original Build: CB1
• Author-supplied patches: CB1
• Author-supplied POVs: POV1
• Browse Source

Known Vulnerabilities

• CWE-126 - Buffer Over-read
CWEs are listed as indicated by the challenge author.

Deployed patches

• Round 77 : Disekt - CB1 (disassembly)
• Round 77 : TECHx - CB1 (disassembly)
• Round 81 : CodeJitsu - CB1 (disassembly)
• Round 81 : Shellphish - CB1 (disassembly)
• Round 86 : CodeJitsu - CB1 (disassembly)
• Round 88 : CodeJitsu - CB1 (disassembly)

Deployed IDS rules

None

DARPA performer group

Kaprica Security (KPRCA)

Description

A C++ audio editor and synthesizer

Feature List

The audio editor provides the ability to generate audio, import/export audio, amplify and pan the audio, and add a reverb effect. The generated audio can be derived from a sine wave, square wave, or white noise. It supports three formats for import and export: uncompressed 32-bit samples, compressed 8-bit samples, and compressed 4-bit samples, with all formats supporting 1 or 2 channels.

The number of tracks is limited only by the available memory. Each track's gain and pan can be individually set. During export, all of the tracks will be mixed together using the appropriate gain.

Vulnerability

Vuln 1

In Interface::importAudio, the attacker supplied number of samples is not checked against the number of bytes sent by the attacker. This may result in the decompression functions accessing memory that is beyond the input buffer. A trivial example can be constructed by providing an input size of 32 bytes and an input header that specifies 64 samples. Using the white noise functionality, an attacker can cause data derived from the secret page to be on the heap and easily converted back to bytes from the secret page.

Generic class of vulnerability

Buffer Over-read

CWE classification

CWE-126: Buffer Over-read

Challenges

• Once the bug is discovered, the CRS must be able to layout the heap so that they get enough bytes that are derived from the secret page
• The only bytes that are derived from the secret page are the bytes used as entropy for the RNG, which have been obfuscated with XOR and must be un-obfuscated to get the secret page bytes

Difficulty

• Discovery: medium
• Proving: medium
• Patching: medium

Round	Source	Destination	Result	POV	Analysis	Video
76	CSDS	CodeJitsu	Failed POV	POV		Watch
76	CSDS	DeepRed	Failed POV	POV		Watch
76	CSDS	Disekt	Failed POV	POV		Watch
76	CSDS	ForAllSecure	Failed POV	POV		Watch
76	CSDS	Shellphish	Failed POV	POV		Watch
76	CSDS	TECHx	Failed POV	POV		Watch
76	DeepRed	CodeJitsu	Failed POV	POV		Watch
76	DeepRed	CSDS	Failed POV	POV		Watch
76	DeepRed	Disekt	Failed POV	POV		Watch
76	DeepRed	ForAllSecure	Failed POV	POV		Watch
76	DeepRed	Shellphish	Failed POV	POV		Watch
76	DeepRed	TECHx	Failed POV	POV		Watch
77	CodeJitsu	Disekt	Failed POV through defenses	POV		Watch
77	CodeJitsu	TECHx	Failed POV through defenses	POV		Watch
77	CSDS	CodeJitsu	Failed POV	POV		Watch
77	CSDS	DeepRed	Failed POV	POV		Watch
77	CSDS	Disekt	Failed POV through defenses	POV		Watch
77	CSDS	ForAllSecure	Failed POV	POV		Watch
77	CSDS	Shellphish	Failed POV	POV		Watch
77	CSDS	TECHx	Failed POV through defenses	POV		Watch
77	DeepRed	CodeJitsu	Failed POV	POV		Watch
77	DeepRed	CSDS	Failed POV	POV		Watch
77	DeepRed	Disekt	Failed POV through defenses	POV		Watch
77	DeepRed	ForAllSecure	Failed POV	POV		Watch
77	DeepRed	Shellphish	Failed POV	POV		Watch
77	DeepRed	TECHx	Failed POV through defenses	POV		Watch
78	CSDS	CodeJitsu	Failed POV	POV		Watch
78	CSDS	DeepRed	Failed POV	POV		Watch
78	CSDS	Disekt	Failed POV through defenses	POV		Watch
78	CSDS	ForAllSecure	Failed POV	POV		Watch
78	CSDS	Shellphish	Failed POV	POV		Watch
78	CSDS	TECHx	Failed POV through defenses	POV		Watch
78	DeepRed	CodeJitsu	Failed POV	POV		Watch
78	DeepRed	CSDS	Failed POV	POV		Watch
78	DeepRed	Disekt	Failed POV through defenses	POV		Watch
78	DeepRed	ForAllSecure	Failed POV	POV		Watch
78	DeepRed	Shellphish	Failed POV	POV		Watch
78	DeepRed	TECHx	Failed POV through defenses	POV		Watch
79	CSDS	CodeJitsu	Failed POV	POV		Watch
79	CSDS	DeepRed	Failed POV	POV		Watch
79	CSDS	Disekt	Failed POV through defenses	POV		Watch
79	CSDS	ForAllSecure	Failed POV	POV		Watch
79	CSDS	Shellphish	Failed POV	POV		Watch
79	CSDS	TECHx	Failed POV through defenses	POV		Watch
79	DeepRed	CodeJitsu	Failed POV	POV		Watch
79	DeepRed	CSDS	Failed POV	POV		Watch
79	DeepRed	Disekt	Failed POV through defenses	POV		Watch
79	DeepRed	ForAllSecure	Failed POV	POV		Watch
79	DeepRed	Shellphish	Failed POV	POV		Watch
79	DeepRed	TECHx	Failed POV through defenses	POV		Watch
80	CSDS	CodeJitsu	Failed POV	POV		Watch
80	CSDS	DeepRed	Failed POV	POV		Watch
80	CSDS	Disekt	Failed POV through defenses	POV		Watch
80	CSDS	ForAllSecure	Failed POV	POV		Watch
80	CSDS	Shellphish	Failed POV	POV		Watch
80	CSDS	TECHx	Failed POV through defenses	POV		Watch
80	DeepRed	CodeJitsu	Failed POV	POV		Watch
80	DeepRed	CSDS	Failed POV	POV		Watch
80	DeepRed	Disekt	Failed POV through defenses	POV		Watch
80	DeepRed	ForAllSecure	Failed POV	POV		Watch
80	DeepRed	Shellphish	Failed POV	POV		Watch
80	DeepRed	TECHx	Failed POV through defenses	POV		Watch
81	CodeJitsu	Shellphish	Failed POV through defenses	POV		Watch
81	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
81	CSDS	DeepRed	Failed POV	POV		Watch
81	CSDS	Disekt	Failed POV through defenses	POV		Watch
81	CSDS	ForAllSecure	Failed POV	POV		Watch
81	CSDS	Shellphish	Failed POV through defenses	POV		Watch
81	CSDS	TECHx	Failed POV through defenses	POV		Watch
81	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
81	DeepRed	CSDS	Failed POV	POV		Watch
81	DeepRed	Disekt	Failed POV through defenses	POV		Watch
81	DeepRed	ForAllSecure	Failed POV	POV		Watch
81	DeepRed	Shellphish	Failed POV through defenses	POV		Watch
81	DeepRed	TECHx	Failed POV through defenses	POV		Watch
82	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
82	CSDS	DeepRed	Failed POV	POV		Watch
82	CSDS	Disekt	Failed POV through defenses	POV		Watch
82	CSDS	ForAllSecure	Failed POV	POV		Watch
82	CSDS	Shellphish	Failed POV through defenses	POV		Watch
82	CSDS	TECHx	Failed POV through defenses	POV		Watch
82	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
82	DeepRed	CSDS	Failed POV	POV		Watch
82	DeepRed	Disekt	Failed POV through defenses	POV		Watch
82	DeepRed	ForAllSecure	Failed POV	POV		Watch
82	DeepRed	Shellphish	Failed POV through defenses	POV		Watch
82	DeepRed	TECHx	Failed POV through defenses	POV		Watch
83	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
83	CSDS	DeepRed	Failed POV	POV		Watch
83	CSDS	Disekt	Failed POV through defenses	POV		Watch
83	CSDS	ForAllSecure	Failed POV	POV		Watch
83	CSDS	Shellphish	Failed POV through defenses	POV		Watch
83	CSDS	TECHx	Failed POV through defenses	POV		Watch
83	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
83	DeepRed	CSDS	Failed POV	POV		Watch
83	DeepRed	Disekt	Failed POV through defenses	POV		Watch
83	DeepRed	ForAllSecure	Failed POV	POV		Watch
83	DeepRed	Shellphish	Failed POV through defenses	POV		Watch
83	DeepRed	TECHx	Failed POV through defenses	POV		Watch
84	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
84	CSDS	DeepRed	Failed POV	POV		Watch
84	CSDS	Disekt	Failed POV through defenses	POV		Watch
84	CSDS	ForAllSecure	Failed POV	POV		Watch
84	CSDS	Shellphish	Failed POV through defenses	POV		Watch
84	CSDS	TECHx	Failed POV through defenses	POV		Watch
84	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
84	DeepRed	CSDS	Failed POV	POV		Watch
84	DeepRed	Disekt	Failed POV through defenses	POV		Watch
84	DeepRed	ForAllSecure	Failed POV	POV		Watch
84	DeepRed	Shellphish	Failed POV through defenses	POV		Watch
84	DeepRed	TECHx	Failed POV through defenses	POV		Watch
85	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
85	CSDS	DeepRed	Failed POV	POV		Watch
85	CSDS	Disekt	Failed POV through defenses	POV		Watch
85	CSDS	ForAllSecure	Failed POV	POV		Watch
85	CSDS	Shellphish	Failed POV through defenses	POV		Watch
85	CSDS	TECHx	Failed POV through defenses	POV		Watch
85	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
85	DeepRed	CSDS	Failed POV	POV		Watch
85	DeepRed	Disekt	Failed POV through defenses	POV		Watch
85	DeepRed	ForAllSecure	Failed POV	POV		Watch
85	DeepRed	Shellphish	Failed POV through defenses	POV		Watch
85	DeepRed	TECHx	Failed POV through defenses	POV		Watch
86	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
86	CSDS	DeepRed	Failed POV	POV		Watch
86	CSDS	Disekt	Failed POV through defenses	POV		Watch
86	CSDS	ForAllSecure	Failed POV	POV		Watch
86	CSDS	Shellphish	Failed POV through defenses	POV		Watch
86	CSDS	TECHx	Failed POV through defenses	POV		Watch
86	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
86	DeepRed	CSDS	Failed POV	POV		Watch
86	DeepRed	Disekt	Failed POV through defenses	POV		Watch
86	DeepRed	ForAllSecure	Failed POV	POV		Watch
86	DeepRed	Shellphish	Failed POV through defenses	POV		Watch
86	DeepRed	TECHx	Failed POV through defenses	POV		Watch
87	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
87	CSDS	DeepRed	Failed POV	POV		Watch
87	CSDS	Disekt	Failed POV through defenses	POV		Watch
87	CSDS	ForAllSecure	Failed POV	POV		Watch
87	CSDS	Shellphish	Failed POV through defenses	POV		Watch
87	CSDS	TECHx	Failed POV through defenses	POV		Watch
87	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
87	DeepRed	CSDS	Failed POV	POV		Watch
87	DeepRed	Disekt	Failed POV through defenses	POV		Watch
87	DeepRed	ForAllSecure	Failed POV	POV		Watch
87	DeepRed	Shellphish	Failed POV through defenses	POV		Watch
87	DeepRed	TECHx	Failed POV through defenses	POV		Watch
88	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
88	CSDS	DeepRed	Failed POV	POV		Watch
88	CSDS	Disekt	Failed POV through defenses	POV		Watch
88	CSDS	ForAllSecure	Failed POV	POV		Watch
88	CSDS	Shellphish	Failed POV through defenses	POV		Watch
88	CSDS	TECHx	Failed POV through defenses	POV		Watch
88	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
88	DeepRed	CSDS	Failed POV	POV		Watch
88	DeepRed	Disekt	Failed POV through defenses	POV		Watch
88	DeepRed	ForAllSecure	Failed POV	POV		Watch
88	DeepRed	Shellphish	Failed POV through defenses	POV		Watch
88	DeepRed	TECHx	Failed POV through defenses	POV		Watch
89	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
89	CSDS	DeepRed	Failed POV	POV		Watch
89	CSDS	Disekt	Failed POV through defenses	POV		Watch
89	CSDS	ForAllSecure	Failed POV	POV		Watch
89	CSDS	Shellphish	Failed POV through defenses	POV		Watch
89	CSDS	TECHx	Failed POV through defenses	POV		Watch
89	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
89	DeepRed	CSDS	Failed POV	POV		Watch
89	DeepRed	Disekt	Failed POV through defenses	POV		Watch
89	DeepRed	ForAllSecure	Failed POV	POV		Watch
89	DeepRed	Shellphish	Failed POV through defenses	POV		Watch
89	DeepRed	TECHx	Failed POV through defenses	POV		Watch
90	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
90	CSDS	DeepRed	Failed POV	POV		Watch
90	CSDS	Disekt	Failed POV through defenses	POV		Watch
90	CSDS	ForAllSecure	Failed POV	POV		Watch
90	CSDS	Shellphish	Failed POV through defenses	POV		Watch
90	CSDS	TECHx	Failed POV through defenses	POV		Watch
90	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
90	DeepRed	CSDS	Failed POV	POV		Watch
90	DeepRed	Disekt	Failed POV through defenses	POV		Watch
90	DeepRed	ForAllSecure	Failed POV	POV		Watch
90	DeepRed	Shellphish	Failed POV through defenses	POV		Watch
90	DeepRed	TECHx	Failed POV through defenses	POV		Watch
91	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
91	CSDS	DeepRed	Failed POV	POV		Watch
91	CSDS	Disekt	Failed POV through defenses	POV		Watch
91	CSDS	ForAllSecure	Failed POV	POV		Watch
91	CSDS	Shellphish	Failed POV through defenses	POV		Watch
91	CSDS	TECHx	Failed POV through defenses	POV		Watch
91	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
91	DeepRed	CSDS	Failed POV	POV		Watch
91	DeepRed	Disekt	Failed POV through defenses	POV		Watch
91	DeepRed	ForAllSecure	Failed POV	POV		Watch
91	DeepRed	Shellphish	Failed POV through defenses	POV		Watch
91	DeepRed	TECHx	Failed POV through defenses	POV		Watch
92	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
92	CSDS	DeepRed	Failed POV	POV		Watch
92	CSDS	Disekt	Failed POV through defenses	POV		Watch
92	CSDS	ForAllSecure	Failed POV	POV		Watch
92	CSDS	Shellphish	Failed POV through defenses	POV		Watch
92	CSDS	TECHx	Failed POV through defenses	POV		Watch
92	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
92	DeepRed	CSDS	Failed POV	POV		Watch
92	DeepRed	Disekt	Failed POV through defenses	POV		Watch
92	DeepRed	ForAllSecure	Failed POV	POV		Watch
92	DeepRed	Shellphish	Failed POV through defenses	POV		Watch
92	DeepRed	TECHx	Failed POV through defenses	POV		Watch
93	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
93	CSDS	DeepRed	Failed POV	POV		Watch
93	CSDS	Disekt	Failed POV through defenses	POV		Watch
93	CSDS	ForAllSecure	Failed POV	POV		Watch
93	CSDS	Shellphish	Failed POV through defenses	POV		Watch
93	CSDS	TECHx	Failed POV through defenses	POV		Watch
93	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
93	DeepRed	CSDS	Failed POV	POV		Watch
93	DeepRed	Disekt	Failed POV through defenses	POV		Watch
93	DeepRed	ForAllSecure	Failed POV	POV		Watch
93	DeepRed	Shellphish	Failed POV through defenses	POV		Watch
93	DeepRed	TECHx	Failed POV through defenses	POV		Watch
94	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
94	CSDS	DeepRed	Failed POV	POV		Watch
94	CSDS	Disekt	Failed POV through defenses	POV		Watch
94	CSDS	ForAllSecure	Failed POV	POV		Watch
94	CSDS	Shellphish	Failed POV through defenses	POV		Watch
94	CSDS	TECHx	Failed POV through defenses	POV		Watch
94	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
94	DeepRed	CSDS	Failed POV	POV		Watch
94	DeepRed	Disekt	Failed POV through defenses	POV		Watch
94	DeepRed	ForAllSecure	Failed POV	POV		Watch
94	DeepRed	Shellphish	Failed POV through defenses	POV		Watch
94	DeepRed	TECHx	Failed POV through defenses	POV		Watch
95	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
95	CSDS	DeepRed	Failed POV	POV		Watch
95	CSDS	Disekt	Failed POV through defenses	POV		Watch
95	CSDS	ForAllSecure	Failed POV	POV		Watch
95	CSDS	Shellphish	Failed POV through defenses	POV		Watch
95	CSDS	TECHx	Failed POV through defenses	POV		Watch
95	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
95	DeepRed	CSDS	Failed POV	POV		Watch
95	DeepRed	Disekt	Failed POV through defenses	POV		Watch
95	DeepRed	ForAllSecure	Failed POV	POV		Watch
95	DeepRed	Shellphish	Failed POV through defenses	POV		Watch
95	DeepRed	TECHx	Failed POV through defenses	POV		Watch