Challenge Information - KPRCA_00101

Commonly known as: Mount_Filemore

Rounds Enabled

0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18

Details

Original Versions

Known Vulnerabilities

  • CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-122 - Heap-based Buffer Overflow
    • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

DARPA performer group

Kaprica Security (KPRCA)

Description

A file system image parser.

Feature List

Mount Filemore allows a user to send a CGFS compliant image for mounting and editing. The full list of commands are: -Mount Filesystem -List File/Directory -Recursively List Files/Directories -Preview File -Read From File -Write To File -Update File Size -Add File -Add Directory -Delete File -Delete Directory -View Mounted Filesystem Metadata -Unmount Filesystem

Vulnerability

Vuln 1

Files are stored across clusters. The clusters are indexed in a table which essentially creates a linked list of indices. The vulnerability occurs in cgfs.cc:342. The unpatched CB does not properly factor in the offset when writing bytes to a cluster. If a user sends num_bytes < cluster_size the offset is not properly accounted for. This allows the an overwrite into the adjacent cluster.

Triggering the exploit requires a little more work. If a user creates a file, creates a directory, and then updates the file size it creates the directory cluster index will be in between the file's clusters. Using the overwrite bug allows writing in the directory cluster and creating a file where the starting cluster points to the secret page (or any arbitrary memory address). The CB keeps all the file entries in memory so in order to get the faux file to show up another file or directory must be added.

Finally the leak is triggered via the PreviewFile feature, which prints the first cluster's data.

Generic class of vulnerability

Heap Corruption

CWE classification

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122 Heap Overflow

Challenges

  • This CB requires the CRS to understand how the filesytem is laid out in memory as well as its indexing system through the filesystem cluster table. The CB also must understand the filesystem metadata entries in order to properly add a file in order to trigger the memory leak.
  • Distinguishing between the directory structure stored in memory as well as the filesystem stored in memory is important for the CRS to reason about the proper set of commands to invoke to trigger the exploit

Difficulty

  • Discovery: medium
  • Proving: hard
  • Patching: easy

POV Information

Round Source Destination Result POV Analysis Video
1 CSDS CodeJitsu Failed POV POV Watch
1 CSDS DeepRed Failed POV POV Watch
1 CSDS Disekt Failed POV POV Watch
1 CSDS ForAllSecure Failed POV POV Watch
1 CSDS Shellphish Failed POV POV Watch
1 CSDS TECHx Failed POV POV Watch
1 DeepRed CodeJitsu Failed POV POV Watch
1 DeepRed CSDS Failed POV POV Watch
1 DeepRed Disekt Failed POV POV Watch
1 DeepRed ForAllSecure Failed POV POV Watch
1 DeepRed Shellphish Failed POV POV Watch
1 DeepRed TECHx Failed POV POV Watch
1 ForAllSecure CodeJitsu Failed POV POV Watch
1 ForAllSecure CSDS Failed POV POV Watch
1 ForAllSecure DeepRed Failed POV POV Watch
1 ForAllSecure Disekt Failed POV POV Watch
1 ForAllSecure Shellphish Failed POV POV Watch
1 ForAllSecure TECHx Failed POV POV Watch
2 CodeJitsu Disekt Failed POV through defenses POV Watch
2 CodeJitsu Shellphish Failed POV through defenses POV Watch
2 CodeJitsu TECHx Failed POV through defenses POV Watch
2 CSDS CodeJitsu Failed POV POV Watch
2 CSDS DeepRed Failed POV POV Watch
2 CSDS Disekt Failed POV through defenses POV Watch
2 CSDS ForAllSecure Failed POV POV Watch
2 CSDS Shellphish Failed POV through defenses POV Watch
2 CSDS TECHx Failed POV through defenses POV Watch
2 DeepRed CodeJitsu Failed POV POV Watch
2 DeepRed CSDS Failed POV POV Watch
2 DeepRed Disekt Failed POV through defenses POV Watch
2 DeepRed ForAllSecure Failed POV POV Watch
2 DeepRed Shellphish Failed POV through defenses POV Watch
2 DeepRed TECHx Failed POV through defenses POV Watch
2 ForAllSecure CodeJitsu Failed POV POV Watch
2 ForAllSecure CSDS Failed POV POV Watch
2 ForAllSecure DeepRed Failed POV POV Watch
2 ForAllSecure Disekt Failed POV through defenses POV Watch
2 ForAllSecure Shellphish Failed POV through defenses POV Watch
2 ForAllSecure TECHx Failed POV through defenses POV Watch
3 CSDS CodeJitsu Failed POV POV Watch
3 CSDS DeepRed Failed POV POV Watch
3 CSDS Disekt Failed POV through defenses POV Watch
3 CSDS ForAllSecure Failed POV POV Watch
3 CSDS Shellphish Failed POV through defenses POV Watch
3 CSDS TECHx Failed POV through defenses POV Watch
3 DeepRed CodeJitsu Failed POV POV Watch
3 DeepRed CSDS Failed POV POV Watch
3 DeepRed Disekt Failed POV through defenses POV Watch
3 DeepRed ForAllSecure Failed POV POV Watch
3 DeepRed Shellphish Failed POV through defenses POV Watch
3 DeepRed TECHx Failed POV through defenses POV Watch
3 ForAllSecure CodeJitsu Failed POV POV Watch
3 ForAllSecure CSDS Failed POV POV Watch
3 ForAllSecure DeepRed Failed POV POV Watch
3 ForAllSecure Disekt Failed POV through defenses POV Watch
3 ForAllSecure Shellphish Failed POV through defenses POV Watch
3 ForAllSecure TECHx Failed POV through defenses POV Watch
4 CSDS CodeJitsu Failed POV POV Watch
4 CSDS DeepRed Failed POV POV Watch
4 CSDS Disekt Failed POV through defenses POV Watch
4 CSDS ForAllSecure Failed POV POV Watch
4 CSDS Shellphish Failed POV through defenses POV Watch
4 CSDS TECHx Failed POV through defenses POV Watch
4 DeepRed CodeJitsu Failed POV POV Watch
4 DeepRed CSDS Failed POV POV Watch
4 DeepRed Disekt Failed POV through defenses POV Watch
4 DeepRed ForAllSecure Failed POV POV Watch
4 DeepRed Shellphish Failed POV through defenses POV Watch
4 DeepRed TECHx Failed POV through defenses POV Watch
4 ForAllSecure CodeJitsu Failed POV POV Watch
4 ForAllSecure CSDS Failed POV POV Watch
4 ForAllSecure DeepRed Failed POV POV Watch
4 ForAllSecure Disekt Failed POV through defenses POV Watch
4 ForAllSecure Shellphish Failed POV through defenses POV Watch
4 ForAllSecure TECHx Failed POV through defenses POV Watch
5 CodeJitsu DeepRed Failed POV through defenses POV Watch
5 CSDS CodeJitsu Failed POV POV Watch
5 CSDS DeepRed Failed POV through defenses POV Watch
5 CSDS Disekt Failed POV through defenses POV Watch
5 CSDS ForAllSecure Failed POV POV Watch
5 CSDS Shellphish Failed POV through defenses POV Watch
5 CSDS TECHx Failed POV through defenses POV Watch
5 DeepRed CodeJitsu Failed POV POV Watch
5 DeepRed CSDS Failed POV POV Watch
5 DeepRed Disekt Failed POV through defenses POV Watch
5 DeepRed ForAllSecure Failed POV POV Watch
5 DeepRed Shellphish Failed POV through defenses POV Watch
5 DeepRed TECHx Failed POV through defenses POV Watch
5 ForAllSecure CodeJitsu Failed POV POV Watch
5 ForAllSecure CSDS Failed POV POV Watch
5 ForAllSecure DeepRed Failed POV through defenses POV Watch
5 ForAllSecure Disekt Failed POV through defenses POV Watch
5 ForAllSecure Shellphish Failed POV through defenses POV Watch
5 ForAllSecure TECHx Failed POV through defenses POV Watch
6 CSDS CodeJitsu Failed POV through defenses POV Watch
6 CSDS DeepRed Failed POV through defenses POV Watch
6 CSDS Disekt Failed POV through defenses POV Watch
6 CSDS ForAllSecure Failed POV POV Watch
6 CSDS Shellphish Failed POV through defenses POV Watch
6 CSDS TECHx Failed POV through defenses POV Watch
6 DeepRed CodeJitsu Failed POV through defenses POV Watch
6 DeepRed CSDS Failed POV POV Watch
6 DeepRed Disekt Failed POV through defenses POV Watch
6 DeepRed ForAllSecure Failed POV POV Watch
6 DeepRed Shellphish Failed POV through defenses POV Watch
6 DeepRed TECHx Failed POV through defenses POV Watch
6 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
6 ForAllSecure CSDS Failed POV POV Watch
6 ForAllSecure DeepRed Failed POV through defenses POV Watch
6 ForAllSecure Disekt Failed POV through defenses POV Watch
6 ForAllSecure Shellphish Failed POV through defenses POV Watch
6 ForAllSecure TECHx Failed POV through defenses POV Watch
7 CSDS CodeJitsu Failed POV through defenses POV Watch
7 CSDS DeepRed Failed POV through defenses POV Watch
7 CSDS Disekt Failed POV through defenses POV Watch
7 CSDS ForAllSecure Failed POV POV Watch
7 CSDS Shellphish Failed POV through defenses POV Watch
7 CSDS TECHx Failed POV through defenses POV Watch
7 DeepRed CodeJitsu Failed POV through defenses POV Watch
7 DeepRed CSDS Failed POV POV Watch
7 DeepRed Disekt Failed POV through defenses POV Watch
7 DeepRed ForAllSecure Failed POV POV Watch
7 DeepRed Shellphish Failed POV through defenses POV Watch
7 DeepRed TECHx Failed POV through defenses POV Watch
7 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
7 ForAllSecure CSDS Failed POV POV Watch
7 ForAllSecure DeepRed Failed POV through defenses POV Watch
7 ForAllSecure Disekt Failed POV through defenses POV Watch
7 ForAllSecure Shellphish Failed POV through defenses POV Watch
7 ForAllSecure TECHx Failed POV through defenses POV Watch
8 CSDS CodeJitsu Failed POV through defenses POV Watch
8 CSDS DeepRed Failed POV through defenses POV Watch
8 CSDS Disekt Failed POV through defenses POV Watch
8 CSDS ForAllSecure Failed POV POV Watch
8 CSDS Shellphish Failed POV through defenses POV Watch
8 CSDS TECHx Failed POV through defenses POV Watch
8 DeepRed CodeJitsu Failed POV through defenses POV Watch
8 DeepRed CSDS Failed POV POV Watch
8 DeepRed Disekt Failed POV through defenses POV Watch
8 DeepRed ForAllSecure Failed POV POV Watch
8 DeepRed Shellphish Failed POV through defenses POV Watch
8 DeepRed TECHx Failed POV through defenses POV Watch
8 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
8 ForAllSecure CSDS Failed POV POV Watch
8 ForAllSecure DeepRed Failed POV through defenses POV Watch
8 ForAllSecure Disekt Failed POV through defenses POV Watch
8 ForAllSecure Shellphish Failed POV through defenses POV Watch
8 ForAllSecure TECHx Failed POV through defenses POV Watch
9 CSDS CodeJitsu Failed POV through defenses POV Watch
9 CSDS Disekt Failed POV through defenses POV Watch
9 CSDS ForAllSecure Failed POV POV Watch
9 CSDS Shellphish Failed POV through defenses POV Watch
9 CSDS TECHx Failed POV through defenses POV Watch
9 DeepRed CodeJitsu Failed POV through defenses POV Watch
9 DeepRed CSDS Failed POV POV Watch
9 DeepRed Disekt Failed POV through defenses POV Watch
9 DeepRed ForAllSecure Failed POV POV Watch
9 DeepRed Shellphish Failed POV through defenses POV Watch
9 DeepRed TECHx Failed POV through defenses POV Watch
9 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
9 ForAllSecure CSDS Failed POV POV Watch
9 ForAllSecure Disekt Failed POV through defenses POV Watch
9 ForAllSecure Shellphish Failed POV through defenses POV Watch
9 ForAllSecure TECHx Failed POV through defenses POV Watch
10 CSDS CodeJitsu Failed POV through defenses POV Watch
10 CSDS DeepRed Failed POV through defenses POV Watch
10 CSDS Disekt Failed POV through defenses POV Watch
10 CSDS ForAllSecure Failed POV POV Watch
10 CSDS Shellphish Failed POV through defenses POV Watch
10 CSDS TECHx Failed POV through defenses POV Watch
10 DeepRed CodeJitsu Failed POV through defenses POV Watch
10 DeepRed CSDS Failed POV POV Watch
10 DeepRed Disekt Failed POV through defenses POV Watch
10 DeepRed ForAllSecure Failed POV POV Watch
10 DeepRed Shellphish Failed POV through defenses POV Watch
10 DeepRed TECHx Failed POV through defenses POV Watch
10 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
10 ForAllSecure CSDS Failed POV POV Watch
10 ForAllSecure DeepRed Failed POV through defenses POV Watch
10 ForAllSecure Disekt Failed POV through defenses POV Watch
10 ForAllSecure Shellphish Failed POV through defenses POV Watch
10 ForAllSecure TECHx Failed POV through defenses POV Watch
11 CSDS CodeJitsu Failed POV through defenses POV Watch
11 CSDS DeepRed Failed POV through defenses POV Watch
11 CSDS Disekt Failed POV through defenses POV Watch
11 CSDS ForAllSecure Failed POV POV Watch
11 CSDS Shellphish Failed POV through defenses POV Watch
11 CSDS TECHx Failed POV through defenses POV Watch
11 DeepRed CodeJitsu Failed POV through defenses POV Watch
11 DeepRed CSDS Failed POV POV Watch
11 DeepRed Disekt Failed POV through defenses POV Watch
11 DeepRed ForAllSecure Failed POV POV Watch
11 DeepRed Shellphish Failed POV through defenses POV Watch
11 DeepRed TECHx Failed POV through defenses POV Watch
11 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
11 ForAllSecure CSDS Failed POV POV Watch
11 ForAllSecure DeepRed Failed POV through defenses POV Watch
11 ForAllSecure Disekt Failed POV through defenses POV Watch
11 ForAllSecure Shellphish Failed POV through defenses POV Watch
11 ForAllSecure TECHx Failed POV through defenses POV Watch
12 CSDS CodeJitsu Failed POV through defenses POV Watch
12 CSDS DeepRed Failed POV through defenses POV Watch
12 CSDS Disekt Failed POV through defenses POV Watch
12 CSDS ForAllSecure Failed POV POV Watch
12 CSDS Shellphish Failed POV through defenses POV Watch
12 CSDS TECHx Failed POV through defenses POV Watch
12 DeepRed CodeJitsu Failed POV through defenses POV Watch
12 DeepRed CSDS Failed POV POV Watch
12 DeepRed Disekt Failed POV through defenses POV Watch
12 DeepRed ForAllSecure Failed POV POV Watch
12 DeepRed Shellphish Failed POV through defenses POV Watch
12 DeepRed TECHx Failed POV through defenses POV Watch
12 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
12 ForAllSecure CSDS Failed POV POV Watch
12 ForAllSecure DeepRed Failed POV through defenses POV Watch
12 ForAllSecure Disekt Failed POV through defenses POV Watch
12 ForAllSecure Shellphish Failed POV through defenses POV Watch
12 ForAllSecure TECHx Failed POV through defenses POV Watch
13 CSDS CodeJitsu Failed POV through defenses POV Watch
13 CSDS DeepRed Failed POV through defenses POV Watch
13 CSDS Disekt Failed POV through defenses POV Watch
13 CSDS ForAllSecure Failed POV POV Watch
13 CSDS Shellphish Failed POV through defenses POV Watch
13 CSDS TECHx Failed POV through defenses POV Watch
13 DeepRed CodeJitsu Failed POV through defenses POV Watch
13 DeepRed CSDS Failed POV POV Watch
13 DeepRed Disekt Failed POV through defenses POV Watch
13 DeepRed ForAllSecure Failed POV POV Watch
13 DeepRed Shellphish Failed POV through defenses POV Watch
13 DeepRed TECHx Failed POV through defenses POV Watch
13 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
13 ForAllSecure CSDS Failed POV POV Watch
13 ForAllSecure DeepRed Failed POV through defenses POV Watch
13 ForAllSecure Disekt Failed POV through defenses POV Watch
13 ForAllSecure Shellphish Failed POV through defenses POV Watch
13 ForAllSecure TECHx Failed POV through defenses POV Watch
14 CSDS CodeJitsu Failed POV through defenses POV Watch
14 CSDS DeepRed Failed POV through defenses POV Watch
14 CSDS Disekt Failed POV through defenses POV Watch
14 CSDS ForAllSecure Failed POV POV Watch
14 CSDS Shellphish Failed POV through defenses POV Watch
14 CSDS TECHx Failed POV through defenses POV Watch
14 DeepRed CodeJitsu Failed POV through defenses POV Watch
14 DeepRed CSDS Failed POV POV Watch
14 DeepRed Disekt Failed POV through defenses POV Watch
14 DeepRed ForAllSecure Failed POV POV Watch
14 DeepRed Shellphish Failed POV through defenses POV Watch
14 DeepRed TECHx Failed POV through defenses POV Watch
14 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
14 ForAllSecure CSDS Failed POV POV Watch
14 ForAllSecure DeepRed Failed POV through defenses POV Watch
14 ForAllSecure Disekt Failed POV through defenses POV Watch
14 ForAllSecure Shellphish Failed POV through defenses POV Watch
14 ForAllSecure TECHx Failed POV through defenses POV Watch
15 CSDS CodeJitsu Failed POV through defenses POV Watch
15 CSDS DeepRed Failed POV through defenses POV Watch
15 CSDS Disekt Failed POV through defenses POV Watch
15 CSDS ForAllSecure Failed POV POV Watch
15 CSDS Shellphish Failed POV through defenses POV Watch
15 CSDS TECHx Failed POV through defenses POV Watch
15 DeepRed CodeJitsu Failed POV through defenses POV Watch
15 DeepRed CSDS Failed POV POV Watch
15 DeepRed Disekt Failed POV through defenses POV Watch
15 DeepRed ForAllSecure Failed POV POV Watch
15 DeepRed Shellphish Failed POV through defenses POV Watch
15 DeepRed TECHx Failed POV through defenses POV Watch
15 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
15 ForAllSecure CSDS Failed POV POV Watch
15 ForAllSecure DeepRed Failed POV through defenses POV Watch
15 ForAllSecure Disekt Failed POV through defenses POV Watch
15 ForAllSecure Shellphish Failed POV through defenses POV Watch
15 ForAllSecure TECHx Failed POV through defenses POV Watch
16 CSDS CodeJitsu Failed POV through defenses POV Watch
16 CSDS DeepRed Failed POV through defenses POV Watch
16 CSDS Disekt Failed POV through defenses POV Watch
16 CSDS ForAllSecure Failed POV POV Watch
16 CSDS Shellphish Failed POV through defenses POV Watch
16 CSDS TECHx Failed POV through defenses POV Watch
16 DeepRed CodeJitsu Failed POV through defenses POV Watch
16 DeepRed CSDS Failed POV POV Watch
16 DeepRed Disekt Failed POV through defenses POV Watch
16 DeepRed ForAllSecure Failed POV POV Watch
16 DeepRed Shellphish Failed POV through defenses POV Watch
16 DeepRed TECHx Failed POV through defenses POV Watch
16 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
16 ForAllSecure CSDS Failed POV POV Watch
16 ForAllSecure DeepRed Failed POV through defenses POV Watch
16 ForAllSecure Disekt Failed POV through defenses POV Watch
16 ForAllSecure Shellphish Failed POV through defenses POV Watch
16 ForAllSecure TECHx Failed POV through defenses POV Watch
17 CSDS CodeJitsu Failed POV through defenses POV Watch
17 CSDS DeepRed Failed POV through defenses POV Watch
17 CSDS Disekt Failed POV through defenses POV Watch
17 CSDS ForAllSecure Failed POV POV Watch
17 CSDS Shellphish Failed POV through defenses POV Watch
17 CSDS TECHx Failed POV through defenses POV Watch
17 DeepRed CodeJitsu Failed POV through defenses POV Watch
17 DeepRed CSDS Failed POV POV Watch
17 DeepRed Disekt Failed POV through defenses POV Watch
17 DeepRed ForAllSecure Failed POV POV Watch
17 DeepRed Shellphish Failed POV through defenses POV Watch
17 DeepRed TECHx Failed POV through defenses POV Watch
17 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
17 ForAllSecure CSDS Failed POV POV Watch
17 ForAllSecure DeepRed Failed POV through defenses POV Watch
17 ForAllSecure Disekt Failed POV through defenses POV Watch
17 ForAllSecure Shellphish Failed POV through defenses POV Watch
17 ForAllSecure TECHx Failed POV through defenses POV Watch
18 CSDS CodeJitsu Failed POV through defenses POV Watch
18 CSDS DeepRed Failed POV through defenses POV Watch
18 CSDS Disekt Failed POV through defenses POV Watch
18 CSDS ForAllSecure Failed POV POV Watch
18 CSDS Shellphish Failed POV through defenses POV Watch
18 CSDS TECHx Failed POV through defenses POV Watch
18 DeepRed CodeJitsu Failed POV through defenses POV Watch
18 DeepRed CSDS Failed POV POV Watch
18 DeepRed Disekt Failed POV through defenses POV Watch
18 DeepRed ForAllSecure Failed POV POV Watch
18 DeepRed Shellphish Failed POV through defenses POV Watch
18 DeepRed TECHx Failed POV through defenses POV Watch
18 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
18 ForAllSecure CSDS Failed POV POV Watch
18 ForAllSecure DeepRed Failed POV through defenses POV Watch
18 ForAllSecure Disekt Failed POV through defenses POV Watch
18 ForAllSecure Shellphish Failed POV through defenses POV Watch
18 ForAllSecure TECHx Failed POV through defenses POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email