Challenge Information - KPRCA_00074

Commonly known as: vFilter


Rounds Enabled

20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34

Details

Original Versions

Known Vulnerabilities

  • CWE-123 - Write-what-where Condition
  • CWE-125 - Out-of-bounds Read
  • CWE-465 - Pointer Issues
  • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

DARPA performer group

Kaprica Security (KPRCA)

Description

A constant-time VM interpreter and validator written in C for fast data filtering. The user provides a filter program and a set of data, which is processed and the results returned.

Feature List

Separate validation and execution stages increases the performance of the interpreter as the amount of data increases. There is a one-time cost to make sure the program is correct, and then the interpreter can make assumptions that increase performance.

Support for many instructions: 13 arthimetic instructions, 4 conditional jumps, byte/half-word/word loads and stores, and read/write system calls. Loops are forbidden to guarantee that the execution is time-bound. During execution, the filter has access to a 1KB stack and the input data. Loads and stores are bounds-checked to prevent undefined behavior.

Vulnerability

Vuln 1

The VM interpreter keeps track of the value stored in each VM register and what memory space the VM register references. Normally, a VM register that holds a number will have a NULL memory space pointer. The interpreter takes advantage of this and ORs the memory space pointers together when performing an ADD or SUB instruction. This works because the validator enforces that the operands are either NUMBER-NUMBER, POINTER-NUMBER, or NUMBER-POINTER. So, the result of the OR is either NULL or a valid memory space pointer.

The interpreter fails to set the memory space pointer to NULL in some cases, which causes the aforementioned assumptions to break. This allows an attacker to construct a payload that results in the two memory space pointers being OR'd together, resulting in a memory space pointer that references attacker supplied memory, namely the VM registers. The attacker can set the length of this fake memory space structure to a large value and use a load instruction to read from any memory address or a store instruction to write to any address.

Generic class of vulnerability

Logic error

CWE classification

CWE-123: Write-what-where Condition CWE-125: Out-of-bounds Read CWE-465: Pointer Issues

Challenges

  • The bug is in a virtual machine interpreter, which makes symbolic execution difficult
  • The bug is dependent on the arrangement of heap allocations
  • Patching is difficult because the bug is specific to this program and the memory access is inside of a loop that will affect performance if it is naively instrumented

Difficulty

  • Discovery: hard
  • Proving: medium
  • Patching: hard

POV Information

Round Source Destination Result POV Analysis Video
21 CSDS CodeJitsu Failed POV POV Watch
21 CSDS DeepRed Failed POV POV Watch
21 CSDS Disekt Failed POV POV Watch
21 CSDS ForAllSecure Failed POV POV Watch
21 CSDS Shellphish Failed POV POV Watch
21 CSDS TECHx Failed POV POV Watch
21 DeepRed CodeJitsu Failed POV POV Watch
21 DeepRed CSDS Failed POV POV Watch
21 DeepRed Disekt Failed POV POV Watch
21 DeepRed ForAllSecure Failed POV POV Watch
21 DeepRed Shellphish Failed POV POV Watch
21 DeepRed TECHx Failed POV POV Watch
21 ForAllSecure CodeJitsu Failed POV POV Watch
21 ForAllSecure CSDS Failed POV POV Watch
21 ForAllSecure DeepRed Failed POV POV Watch
21 ForAllSecure Disekt Failed POV POV Watch
21 ForAllSecure Shellphish Failed POV POV Watch
21 ForAllSecure TECHx Failed POV POV Watch
22 CodeJitsu Disekt Failed POV through defenses POV Watch
22 CodeJitsu Shellphish Failed POV through defenses POV Watch
22 CSDS CodeJitsu Failed POV through defenses POV Watch
22 CSDS DeepRed Failed POV POV Watch
22 CSDS Disekt Failed POV through defenses POV Watch
22 CSDS ForAllSecure Failed POV POV Watch
22 CSDS Shellphish Failed POV through defenses POV Watch
22 CSDS TECHx Failed POV POV Watch
22 DeepRed CodeJitsu Failed POV through defenses POV Watch
22 DeepRed CSDS Failed POV POV Watch
22 DeepRed Disekt Failed POV through defenses POV Watch
22 DeepRed ForAllSecure Failed POV POV Watch
22 DeepRed Shellphish Failed POV through defenses POV Watch
22 DeepRed TECHx Failed POV POV Watch
22 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
22 ForAllSecure CSDS Failed POV POV Watch
22 ForAllSecure DeepRed Failed POV POV Watch
22 ForAllSecure Disekt Failed POV through defenses POV Watch
22 ForAllSecure Shellphish Failed POV through defenses POV Watch
22 ForAllSecure TECHx Failed POV POV Watch
23 CodeJitsu Shellphish Failed POV through defenses POV Watch
23 CSDS CodeJitsu Failed POV through defenses POV Watch
23 CSDS DeepRed Failed POV POV Watch
23 CSDS Disekt Failed POV through defenses POV Watch
23 CSDS ForAllSecure Failed POV POV Watch
23 CSDS Shellphish Failed POV through defenses POV Watch
23 CSDS TECHx Failed POV POV Watch
23 DeepRed CodeJitsu Failed POV through defenses POV Watch
23 DeepRed CSDS Failed POV POV Watch
23 DeepRed Disekt Failed POV through defenses POV Watch
23 DeepRed ForAllSecure Failed POV POV Watch
23 DeepRed Shellphish Failed POV through defenses POV Watch
23 DeepRed TECHx Failed POV POV Watch
23 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
23 ForAllSecure CSDS Failed POV POV Watch
23 ForAllSecure DeepRed Failed POV POV Watch
23 ForAllSecure Disekt Failed POV through defenses POV Watch
23 ForAllSecure Shellphish Failed POV through defenses POV Watch
23 ForAllSecure TECHx Failed POV POV Watch
24 CSDS CodeJitsu Failed POV through defenses POV Watch
24 CSDS DeepRed Failed POV POV Watch
24 CSDS Disekt Failed POV through defenses POV Watch
24 CSDS ForAllSecure Failed POV POV Watch
24 CSDS Shellphish Failed POV through defenses POV Watch
24 CSDS TECHx Failed POV POV Watch
24 DeepRed CodeJitsu Failed POV through defenses POV Watch
24 DeepRed CSDS Failed POV POV Watch
24 DeepRed Disekt Failed POV through defenses POV Watch
24 DeepRed ForAllSecure Failed POV POV Watch
24 DeepRed Shellphish Failed POV through defenses POV Watch
24 DeepRed TECHx Failed POV POV Watch
24 Disekt CodeJitsu Failed POV through defenses POV Watch
24 Disekt CSDS Failed POV POV Watch
24 Disekt DeepRed Failed POV POV Watch
24 Disekt ForAllSecure Failed POV POV Watch
24 Disekt Shellphish Failed POV through defenses POV Watch
24 Disekt TECHx Failed POV POV Watch
24 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
24 ForAllSecure CSDS Failed POV POV Watch
24 ForAllSecure DeepRed Failed POV POV Watch
24 ForAllSecure Disekt Failed POV through defenses POV Watch
24 ForAllSecure Shellphish Failed POV through defenses POV Watch
24 ForAllSecure TECHx Failed POV POV Watch
25 CSDS CodeJitsu Failed POV through defenses POV Watch
25 CSDS DeepRed Failed POV POV Watch
25 CSDS Disekt Failed POV through defenses POV Watch
25 CSDS ForAllSecure Failed POV POV Watch
25 CSDS Shellphish Failed POV through defenses POV Watch
25 CSDS TECHx Failed POV POV Watch
25 DeepRed CodeJitsu Failed POV through defenses POV Watch
25 DeepRed CSDS Failed POV POV Watch
25 DeepRed Disekt Failed POV through defenses POV Watch
25 DeepRed ForAllSecure Failed POV POV Watch
25 DeepRed Shellphish Failed POV through defenses POV Watch
25 DeepRed TECHx Failed POV POV Watch
25 Disekt CodeJitsu Failed POV through defenses POV Watch
25 Disekt CSDS Failed POV POV Watch
25 Disekt DeepRed Failed POV POV Watch
25 Disekt ForAllSecure Failed POV POV Watch
25 Disekt Shellphish Failed POV through defenses POV Watch
25 Disekt TECHx Failed POV POV Watch
25 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
25 ForAllSecure CSDS Failed POV POV Watch
25 ForAllSecure DeepRed Failed POV POV Watch
25 ForAllSecure Disekt Failed POV through defenses POV Watch
25 ForAllSecure Shellphish Failed POV through defenses POV Watch
25 ForAllSecure TECHx Failed POV POV Watch
26 CodeJitsu CSDS Failed POV through defenses POV Watch
26 CodeJitsu Shellphish Failed POV POV Watch
26 CodeJitsu TECHx Failed POV through defenses POV Watch
26 CSDS CodeJitsu Failed POV through defenses POV Watch
26 CSDS Disekt Failed POV through defenses POV Watch
26 CSDS ForAllSecure Failed POV POV Watch
26 CSDS Shellphish Failed POV POV Watch
26 CSDS TECHx Failed POV through defenses POV Watch
26 DeepRed CodeJitsu Failed POV through defenses POV Watch
26 DeepRed CSDS Failed POV through defenses POV Watch
26 DeepRed Disekt Failed POV through defenses POV Watch
26 DeepRed ForAllSecure Failed POV POV Watch
26 DeepRed Shellphish Failed POV POV Watch
26 DeepRed TECHx Failed POV through defenses POV Watch
26 Disekt CodeJitsu Failed POV through defenses POV Watch
26 Disekt CSDS Failed POV through defenses POV Watch
26 Disekt ForAllSecure Failed POV POV Watch
26 Disekt Shellphish Failed POV POV Watch
26 Disekt TECHx Failed POV through defenses POV Watch
26 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
26 ForAllSecure CSDS Failed POV through defenses POV Watch
26 ForAllSecure Disekt Failed POV through defenses POV Watch
26 ForAllSecure Shellphish Failed POV POV Watch
26 ForAllSecure TECHx Failed POV through defenses POV Watch
27 CSDS CodeJitsu Failed POV through defenses POV Watch
27 CSDS DeepRed Failed POV through defenses POV Watch
27 CSDS Disekt Failed POV through defenses POV Watch
27 CSDS ForAllSecure Failed POV POV Watch
27 CSDS Shellphish Failed POV POV Watch
27 CSDS TECHx Failed POV through defenses POV Watch
27 DeepRed CodeJitsu Failed POV through defenses POV Watch
27 DeepRed CSDS Failed POV through defenses POV Watch
27 DeepRed Disekt Failed POV through defenses POV Watch
27 DeepRed ForAllSecure Failed POV POV Watch
27 DeepRed Shellphish Failed POV POV Watch
27 DeepRed TECHx Failed POV through defenses POV Watch
27 Disekt CodeJitsu Failed POV through defenses POV Watch
27 Disekt CSDS Failed POV through defenses POV Watch
27 Disekt DeepRed Failed POV through defenses POV Watch
27 Disekt ForAllSecure Failed POV POV Watch
27 Disekt Shellphish Failed POV POV Watch
27 Disekt TECHx Failed POV through defenses POV Watch
27 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
27 ForAllSecure CSDS Failed POV through defenses POV Watch
27 ForAllSecure DeepRed Failed POV through defenses POV Watch
27 ForAllSecure Disekt Failed POV through defenses POV Watch
27 ForAllSecure Shellphish Failed POV POV Watch
27 ForAllSecure TECHx Failed POV through defenses POV Watch
28 CSDS CodeJitsu Failed POV through defenses POV Watch
28 CSDS DeepRed Failed POV through defenses POV Watch
28 CSDS Disekt Failed POV through defenses POV Watch
28 CSDS ForAllSecure Failed POV POV Watch
28 CSDS Shellphish Failed POV POV Watch
28 CSDS TECHx Failed POV through defenses POV Watch
28 DeepRed CodeJitsu Failed POV through defenses POV Watch
28 DeepRed CSDS Failed POV through defenses POV Watch
28 DeepRed Disekt Failed POV through defenses POV Watch
28 DeepRed ForAllSecure Failed POV POV Watch
28 DeepRed Shellphish Failed POV POV Watch
28 DeepRed TECHx Failed POV through defenses POV Watch
28 Disekt CodeJitsu Failed POV through defenses POV Watch
28 Disekt CSDS Failed POV through defenses POV Watch
28 Disekt DeepRed Failed POV through defenses POV Watch
28 Disekt ForAllSecure Failed POV POV Watch
28 Disekt Shellphish Failed POV POV Watch
28 Disekt TECHx Failed POV through defenses POV Watch
28 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
28 ForAllSecure CSDS Failed POV through defenses POV Watch
28 ForAllSecure DeepRed Failed POV through defenses POV Watch
28 ForAllSecure Disekt Failed POV through defenses POV Watch
28 ForAllSecure Shellphish Failed POV POV Watch
28 ForAllSecure TECHx Failed POV through defenses POV Watch
29 CSDS CodeJitsu Failed POV through defenses POV Watch
29 CSDS Disekt Failed POV through defenses POV Watch
29 CSDS ForAllSecure Failed POV POV Watch
29 CSDS Shellphish Failed POV POV Watch
29 CSDS TECHx Failed POV through defenses POV Watch
29 DeepRed CodeJitsu Failed POV through defenses POV Watch
29 DeepRed CSDS Failed POV through defenses POV Watch
29 DeepRed Disekt Failed POV through defenses POV Watch
29 DeepRed ForAllSecure Failed POV POV Watch
29 DeepRed Shellphish Failed POV POV Watch
29 DeepRed TECHx Failed POV through defenses POV Watch
29 Disekt CodeJitsu Failed POV through defenses POV Watch
29 Disekt CSDS Failed POV through defenses POV Watch
29 Disekt ForAllSecure Failed POV POV Watch
29 Disekt Shellphish Failed POV POV Watch
29 Disekt TECHx Failed POV through defenses POV Watch
29 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
29 ForAllSecure CSDS Failed POV through defenses POV Watch
29 ForAllSecure Disekt Failed POV through defenses POV Watch
29 ForAllSecure Shellphish Failed POV POV Watch
29 ForAllSecure TECHx Failed POV through defenses POV Watch
30 CSDS CodeJitsu Failed POV through defenses POV Watch
30 CSDS DeepRed Failed POV POV Watch
30 CSDS Disekt Failed POV through defenses POV Watch
30 CSDS ForAllSecure Failed POV POV Watch
30 CSDS Shellphish Failed POV POV Watch
30 CSDS TECHx Failed POV through defenses POV Watch
30 DeepRed CodeJitsu Failed POV through defenses POV Watch
30 DeepRed CSDS Failed POV through defenses POV Watch
30 DeepRed Disekt Failed POV through defenses POV Watch
30 DeepRed ForAllSecure Failed POV POV Watch
30 DeepRed Shellphish Failed POV POV Watch
30 DeepRed TECHx Failed POV through defenses POV Watch
30 Disekt CodeJitsu Failed POV through defenses POV Watch
30 Disekt CSDS Failed POV through defenses POV Watch
30 Disekt DeepRed Failed POV POV Watch
30 Disekt ForAllSecure Failed POV POV Watch
30 Disekt Shellphish Failed POV POV Watch
30 Disekt TECHx Failed POV through defenses POV Watch
30 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
30 ForAllSecure CSDS Failed POV through defenses POV Watch
30 ForAllSecure DeepRed Failed POV POV Watch
30 ForAllSecure Disekt Failed POV through defenses POV Watch
30 ForAllSecure Shellphish Failed POV POV Watch
30 ForAllSecure TECHx Failed POV through defenses POV Watch
31 CSDS CodeJitsu Failed POV POV Watch
31 CSDS DeepRed Failed POV POV Watch
31 CSDS Disekt Failed POV through defenses POV Watch
31 CSDS ForAllSecure Failed POV POV Watch
31 CSDS Shellphish Failed POV POV Watch
31 CSDS TECHx Failed POV through defenses POV Watch
31 DeepRed CodeJitsu Failed POV POV Watch
31 DeepRed CSDS Failed POV through defenses POV Watch
31 DeepRed Disekt Failed POV through defenses POV Watch
31 DeepRed ForAllSecure Failed POV POV Watch
31 DeepRed Shellphish Failed POV POV Watch
31 DeepRed TECHx Failed POV through defenses POV Watch
31 Disekt CodeJitsu Failed POV POV Watch
31 Disekt CSDS Failed POV through defenses POV Watch
31 Disekt DeepRed Failed POV POV Watch
31 Disekt ForAllSecure Failed POV POV Watch
31 Disekt Shellphish Failed POV POV Watch
31 Disekt TECHx Failed POV through defenses POV Watch
31 ForAllSecure CodeJitsu Failed POV POV Watch
31 ForAllSecure CSDS Failed POV through defenses POV Watch
31 ForAllSecure DeepRed Failed POV POV Watch
31 ForAllSecure Disekt Failed POV through defenses POV Watch
31 ForAllSecure Shellphish Failed POV POV Watch
31 ForAllSecure TECHx Failed POV through defenses POV Watch
32 CSDS CodeJitsu Failed POV POV Watch
32 CSDS DeepRed Failed POV POV Watch
32 CSDS Disekt Failed POV through defenses POV Watch
32 CSDS ForAllSecure Failed POV POV Watch
32 CSDS Shellphish Failed POV POV Watch
32 CSDS TECHx Failed POV through defenses POV Watch
32 DeepRed CodeJitsu Failed POV POV Watch
32 DeepRed CSDS Failed POV through defenses POV Watch
32 DeepRed Disekt Failed POV through defenses POV Watch
32 DeepRed ForAllSecure Failed POV POV Watch
32 DeepRed Shellphish Failed POV POV Watch
32 DeepRed TECHx Failed POV through defenses POV Watch
32 Disekt CodeJitsu Failed POV POV Watch
32 Disekt CSDS Failed POV through defenses POV Watch
32 Disekt DeepRed Failed POV POV Watch
32 Disekt ForAllSecure Failed POV POV Watch
32 Disekt Shellphish Failed POV POV Watch
32 Disekt TECHx Failed POV through defenses POV Watch
32 ForAllSecure CodeJitsu Failed POV POV Watch
32 ForAllSecure CSDS Failed POV through defenses POV Watch
32 ForAllSecure DeepRed Failed POV POV Watch
32 ForAllSecure Disekt Failed POV through defenses POV Watch
32 ForAllSecure Shellphish Failed POV POV Watch
32 ForAllSecure TECHx Failed POV through defenses POV Watch
33 CSDS CodeJitsu Failed POV POV Watch
33 CSDS DeepRed Failed POV POV Watch
33 CSDS Disekt Failed POV through defenses POV Watch
33 CSDS ForAllSecure Failed POV POV Watch
33 CSDS Shellphish Failed POV POV Watch
33 CSDS TECHx Failed POV through defenses POV Watch
33 DeepRed CodeJitsu Failed POV POV Watch
33 DeepRed CSDS Failed POV through defenses POV Watch
33 DeepRed Disekt Failed POV through defenses POV Watch
33 DeepRed ForAllSecure Failed POV POV Watch
33 DeepRed Shellphish Failed POV POV Watch
33 DeepRed TECHx Failed POV through defenses POV Watch
33 Disekt CodeJitsu Failed POV POV Watch
33 Disekt CSDS Failed POV through defenses POV Watch
33 Disekt DeepRed Failed POV POV Watch
33 Disekt ForAllSecure Failed POV POV Watch
33 Disekt Shellphish Failed POV POV Watch
33 Disekt TECHx Failed POV through defenses POV Watch
33 ForAllSecure CodeJitsu Failed POV POV Watch
33 ForAllSecure CSDS Failed POV through defenses POV Watch
33 ForAllSecure DeepRed Failed POV POV Watch
33 ForAllSecure Disekt Failed POV through defenses POV Watch
33 ForAllSecure Shellphish Failed POV POV Watch
33 ForAllSecure TECHx Failed POV through defenses POV Watch
34 CSDS CodeJitsu Failed POV POV Watch
34 CSDS DeepRed Failed POV POV Watch
34 CSDS Disekt Failed POV through defenses POV Watch
34 CSDS ForAllSecure Failed POV POV Watch
34 CSDS Shellphish Failed POV POV Watch
34 CSDS TECHx Failed POV through defenses POV Watch
34 DeepRed CodeJitsu Failed POV POV Watch
34 DeepRed CSDS Failed POV through defenses POV Watch
34 DeepRed Disekt Failed POV through defenses POV Watch
34 DeepRed ForAllSecure Failed POV POV Watch
34 DeepRed Shellphish Failed POV POV Watch
34 DeepRed TECHx Failed POV through defenses POV Watch
34 Disekt CodeJitsu Failed POV POV Watch
34 Disekt CSDS Failed POV through defenses POV Watch
34 Disekt DeepRed Failed POV POV Watch
34 Disekt ForAllSecure Failed POV POV Watch
34 Disekt Shellphish Failed POV POV Watch
34 Disekt TECHx Failed POV through defenses POV Watch
34 ForAllSecure CodeJitsu Failed POV POV Watch
34 ForAllSecure CSDS Failed POV through defenses POV Watch
34 ForAllSecure DeepRed Failed POV POV Watch
34 ForAllSecure Disekt Failed POV through defenses POV Watch
34 ForAllSecure Shellphish Failed POV POV Watch
34 ForAllSecure TECHx Failed POV through defenses POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email