Challenge Information - KPRCA_00112

Commonly known as: Gridder

Rounds Enabled

81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95

Details

Original Versions

Known Vulnerabilities

  • CWE-121 - Stack-based Buffer Overflow
  • CWE-681 - Incorrect Conversion between Numeric Types
    • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

None

DARPA performer group

Kaprica Security (KPRCA)

Description

A simple game that sends a user a 81 cell (9x9) grid. Each cell has a value in it 1-9 and must adhere to 3 simple rules. A cell's value must be unique to its row, column, and 3x3 subgrid the value is contained in.

Feature List

The CB stores 0-1 gridders at any given time. A player may: -Request a new Gridder -Submit a solution to the Gridder -Ask for the max/min difficulty settings -Give up on a current gridder -Change Difficulty

Vulnerability

Vuln 1

When sending a gridder solution, the player client first sends an int containting the number of cells, which should be 81, immediately proceeded by 81 32bit ints. The value check casts the integer into a short to conform with the variable (service.cc:170) storing the board's number of cells. This allows the client to submit a value where if it's mod by the max short = 81 the check will pass. The raw integer is sent to the recv_board function and allows the overwrite. The overwrite is limited to one byte because recv_board does a check to ensure the number of bytes read is no more than G_GRIDDER_SIZE. In the unpatched binary, G_GRIDDER_SIZE is incorecctly assigned to (NUM_CELLS + 1) * sizeof(unsigned int); service.cc:72 This overwrites the pointer to the error table and allows the attacker to arbitrarily read any 4 bytes, as long as they submit a correctly solved gridder.

Generic class of vulnerability

Buffer overflow

CWE classification

CWE-681: Incorrect Conversion between Numeric Types CWE-121 Stack based Buffer Overflow

Challenges

  • The CB implements a simple game that must be properly played in order to enable the type-2 vulnerability.

Difficulty

  • Discovery: easy
  • Proving: medium
  • Patching: easy

POV Information

Round Source Destination Result POV Analysis Video
82 CSDS CodeJitsu Failed POV POV Watch
82 CSDS DeepRed Failed POV POV Watch
82 CSDS Disekt Failed POV POV Watch
82 CSDS ForAllSecure Failed POV POV Watch
82 CSDS Shellphish Failed POV POV Watch
82 CSDS TECHx Failed POV POV Watch
82 DeepRed CodeJitsu Failed POV POV Watch
82 DeepRed CSDS Failed POV POV
82 DeepRed Disekt Failed POV POV
82 DeepRed ForAllSecure Failed POV POV Watch
82 DeepRed Shellphish Failed POV POV Watch
82 DeepRed TECHx Failed POV POV Watch
83 CodeJitsu Disekt Failed POV through defenses POV Watch
83 CSDS CodeJitsu Failed POV POV Watch
83 CSDS DeepRed Failed POV POV Watch
83 CSDS Disekt Failed POV through defenses POV Watch
83 CSDS ForAllSecure Failed POV POV Watch
83 CSDS Shellphish Failed POV POV Watch
83 CSDS TECHx Failed POV POV Watch
83 DeepRed CodeJitsu Failed POV POV Watch
83 DeepRed CSDS Failed POV POV
83 DeepRed Disekt Failed POV through defenses POV Watch
83 DeepRed ForAllSecure Failed POV POV Watch
83 DeepRed Shellphish Failed POV POV Watch
83 DeepRed TECHx Failed POV POV Watch
84 CSDS CodeJitsu Failed POV POV Watch
84 CSDS DeepRed Failed POV POV Watch
84 CSDS Disekt Failed POV through defenses POV Watch
84 CSDS ForAllSecure Failed POV POV Watch
84 CSDS Shellphish Failed POV POV Watch
84 CSDS TECHx Failed POV POV Watch
84 DeepRed CodeJitsu Failed POV POV Watch
84 DeepRed CSDS Failed POV POV
84 DeepRed Disekt Failed POV through defenses POV Watch
84 DeepRed ForAllSecure Failed POV POV Watch
84 DeepRed Shellphish Failed POV POV Watch
84 DeepRed TECHx Failed POV POV Watch
85 CSDS CodeJitsu Failed POV POV Watch
85 CSDS DeepRed Failed POV POV Watch
85 CSDS Disekt Failed POV through defenses POV Watch
85 CSDS ForAllSecure Failed POV POV Watch
85 CSDS Shellphish Failed POV POV Watch
85 CSDS TECHx Failed POV POV Watch
85 DeepRed CodeJitsu Failed POV POV Watch
85 DeepRed CSDS Failed POV POV
85 DeepRed Disekt Failed POV through defenses POV Watch
85 DeepRed ForAllSecure Failed POV POV Watch
85 DeepRed Shellphish Failed POV POV Watch
85 DeepRed TECHx Failed POV POV Watch
86 CodeJitsu Shellphish Failed POV through defenses POV Watch
86 CSDS CodeJitsu Failed POV POV Watch
86 CSDS DeepRed Failed POV POV Watch
86 CSDS Disekt Failed POV through defenses POV Watch
86 CSDS ForAllSecure Failed POV POV Watch
86 CSDS Shellphish Failed POV through defenses POV Watch
86 CSDS TECHx Failed POV POV Watch
86 DeepRed CodeJitsu Failed POV POV Watch
86 DeepRed CSDS Failed POV POV
86 DeepRed Disekt Failed POV through defenses POV Watch
86 DeepRed ForAllSecure Failed POV POV Watch
86 DeepRed Shellphish Failed POV through defenses POV Watch
86 DeepRed TECHx Failed POV POV Watch
87 CSDS CodeJitsu Failed POV POV Watch
87 CSDS DeepRed Failed POV POV Watch
87 CSDS Disekt Failed POV through defenses POV Watch
87 CSDS ForAllSecure Failed POV POV Watch
87 CSDS Shellphish Failed POV through defenses POV Watch
87 CSDS TECHx Failed POV POV Watch
87 DeepRed CodeJitsu Failed POV POV Watch
87 DeepRed CSDS Failed POV POV
87 DeepRed Disekt Failed POV through defenses POV Watch
87 DeepRed ForAllSecure Failed POV POV Watch
87 DeepRed Shellphish Failed POV through defenses POV Watch
87 DeepRed TECHx Failed POV POV Watch
88 CSDS CodeJitsu Failed POV POV Watch
88 CSDS DeepRed Failed POV POV Watch
88 CSDS Disekt Failed POV through defenses POV Watch
88 CSDS ForAllSecure Failed POV POV Watch
88 CSDS Shellphish Failed POV through defenses POV Watch
88 CSDS TECHx Failed POV POV Watch
88 DeepRed CodeJitsu Failed POV POV Watch
88 DeepRed CSDS Failed POV POV
88 DeepRed Disekt Failed POV through defenses POV Watch
88 DeepRed ForAllSecure Failed POV POV Watch
88 DeepRed Shellphish Failed POV through defenses POV Watch
88 DeepRed TECHx Failed POV POV Watch
89 CSDS CodeJitsu Failed POV POV Watch
89 CSDS DeepRed Failed POV POV Watch
89 CSDS Disekt Failed POV through defenses POV Watch
89 CSDS ForAllSecure Failed POV POV Watch
89 CSDS Shellphish Failed POV through defenses POV Watch
89 CSDS TECHx Failed POV POV Watch
89 DeepRed CodeJitsu Failed POV POV Watch
89 DeepRed CSDS Failed POV POV
89 DeepRed Disekt Failed POV through defenses POV Watch
89 DeepRed ForAllSecure Failed POV POV Watch
89 DeepRed Shellphish Failed POV through defenses POV Watch
89 DeepRed TECHx Failed POV POV Watch
90 CSDS CodeJitsu Failed POV POV Watch
90 CSDS DeepRed Failed POV POV Watch
90 CSDS Disekt Failed POV through defenses POV Watch
90 CSDS ForAllSecure Failed POV POV Watch
90 CSDS Shellphish Failed POV through defenses POV Watch
90 CSDS TECHx Failed POV POV Watch
90 DeepRed CodeJitsu Failed POV POV Watch
90 DeepRed CSDS Failed POV POV
90 DeepRed Disekt Failed POV through defenses POV Watch
90 DeepRed ForAllSecure Failed POV POV Watch
90 DeepRed Shellphish Failed POV through defenses POV Watch
90 DeepRed TECHx Failed POV POV Watch
91 CSDS CodeJitsu Failed POV POV Watch
91 CSDS DeepRed Failed POV POV Watch
91 CSDS Disekt Failed POV through defenses POV Watch
91 CSDS ForAllSecure Failed POV POV Watch
91 CSDS Shellphish Failed POV through defenses POV Watch
91 CSDS TECHx Failed POV POV Watch
91 DeepRed CodeJitsu Failed POV POV Watch
91 DeepRed CSDS Failed POV POV
91 DeepRed Disekt Failed POV through defenses POV Watch
91 DeepRed ForAllSecure Failed POV POV Watch
91 DeepRed Shellphish Failed POV through defenses POV Watch
91 DeepRed TECHx Failed POV POV Watch
92 CSDS CodeJitsu Failed POV POV Watch
92 CSDS DeepRed Failed POV POV Watch
92 CSDS Disekt Failed POV through defenses POV Watch
92 CSDS ForAllSecure Failed POV POV Watch
92 CSDS Shellphish Failed POV through defenses POV Watch
92 CSDS TECHx Failed POV POV Watch
92 DeepRed CodeJitsu Failed POV POV Watch
92 DeepRed CSDS Failed POV POV
92 DeepRed Disekt Failed POV through defenses POV Watch
92 DeepRed ForAllSecure Failed POV POV Watch
92 DeepRed Shellphish Failed POV through defenses POV Watch
92 DeepRed TECHx Failed POV POV Watch
93 CSDS CodeJitsu Failed POV POV Watch
93 CSDS DeepRed Failed POV POV Watch
93 CSDS Disekt Failed POV through defenses POV Watch
93 CSDS ForAllSecure Failed POV POV Watch
93 CSDS Shellphish Failed POV through defenses POV Watch
93 CSDS TECHx Failed POV POV Watch
93 DeepRed CodeJitsu Failed POV POV Watch
93 DeepRed CSDS Failed POV POV
93 DeepRed Disekt Failed POV through defenses POV Watch
93 DeepRed ForAllSecure Failed POV POV Watch
93 DeepRed Shellphish Failed POV through defenses POV Watch
93 DeepRed TECHx Failed POV POV Watch
94 CSDS CodeJitsu Failed POV POV Watch
94 CSDS DeepRed Failed POV POV Watch
94 CSDS Disekt Failed POV through defenses POV Watch
94 CSDS ForAllSecure Failed POV POV Watch
94 CSDS Shellphish Failed POV through defenses POV Watch
94 CSDS TECHx Failed POV POV Watch
94 DeepRed CodeJitsu Failed POV POV Watch
94 DeepRed CSDS Failed POV POV
94 DeepRed Disekt Failed POV through defenses POV Watch
94 DeepRed ForAllSecure Failed POV POV Watch
94 DeepRed Shellphish Failed POV through defenses POV Watch
94 DeepRed TECHx Failed POV POV Watch
95 CSDS CodeJitsu Failed POV POV Watch
95 CSDS DeepRed Failed POV POV Watch
95 CSDS Disekt Failed POV through defenses POV Watch
95 CSDS ForAllSecure Failed POV POV Watch
95 CSDS Shellphish Failed POV through defenses POV Watch
95 CSDS TECHx Failed POV POV Watch
95 DeepRed CodeJitsu Failed POV POV Watch
95 DeepRed CSDS Failed POV POV
95 DeepRed Disekt Failed POV through defenses POV Watch
95 DeepRed ForAllSecure Failed POV POV Watch
95 DeepRed Shellphish Failed POV through defenses POV Watch
95 DeepRed TECHx Failed POV POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email