Challenge Information - NRFIN_00055

Commonly known as: COLLIDEOSCOPE

Rounds Enabled

17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31

Details

Original Versions

Known Vulnerabilities

  • CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-703 - Improper Check or Handling of Exceptional Conditions
  • CWE-704 - Incorrect Type Conversion or Cast
  • CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
    • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

Author Information

"Maxwell Koo" info@narfindustries.com

DARPA performer group

Narf Industries (NRFIN)

Description

COLLIDEOSCOPE brings convenient four-function signed 32-bit integer math to your fingertips! Now supporting pointer types and variables. Enter in arbitrary algebraic expressions and let us do the hard math for you!

Feature List

  • Parses algebraic expressions containing integer values and common arithmatic functions
  • Create variables consisting of up to 4 lowercase characters for storing past results
  • Convenient workbook functionality by storing past results in a special variable
  • Reference variables by taking and dereferencing pointers
  • Operator precedence and parenthesis supported
  • Supports addition, subtraction, multiplication, division and negation

Vulnerability 1

This program differentiates between pointer variables and integer variables who's values are stored in a hash table. Upon assigning the incorrect typed value to an existing variable, a new variable with that name will be created with the new type, and the old variable will have its type field clobbered while persisting its old value. As lookups will prefer the first created variable, this can be used to gain arbitrary read and write access to the processes' memory space.

Generic class of vulnerability

Type confusion

CWE classification

CWE-119 Improper restriction of operations within the bounds of a memory buffer CWE-703 Improper check or handling of exceptional conditions CWE-704 Incorrect type conversion or cast CWE-843 Access of resource using incompatible type

Challenges

  • The tool requires well-formed algebraic expressions in order to provide meaningful results, requiring passing a tokenization stage and parsing stage prior to reaching the vulnerability in the evaluation stage, increasing the difficulty of random fuzzing.
  • Successfully exercising the vulnerability requires manipulation of the calculator's variable space over several successful operations with a particular structure.
  • Bounds checks inserted around the variable dereferencing logic may be effective in fixing this vulnerability, once the proper patching location is identified by overcoming the above challenges.

Difficulty

  • Discovering is hard
  • Proving is medium
  • Fixing is easy

Vulnerability 2

The negation operator of this program does not correctly update the type of its destination argument field, allowing an attacker to negate an integer and assign the resulting value to a pointer variable, allowing arbitrary read and write access to the processes memory space.

Generic class of vulnerability

Type confusion

CWE classification

CWE-119 Improper restriction of operations within the bounds of a memory buffer CWE-703 Improper check or handling of exceptional conditions CWE-704 Incorrect type conversion or cast CWE-843 Access of resource using incompatible type

Challenges

  • All of the challenges for vulnerability 1 also apply to this vulnerability
  • Control over the pointer value is limited by the range of signed integer types, would need to nest negations in order to dereference a pointer in the flag page for instance
  • A very specific set of operations is needed to exercise this vulnerability, namely negating a value at the top level then dereferencing the result variable before its type field is clobbered.
  • Bounds checks in the proper locations could also address this vulnerability.

Difficulty

  • Discovering is hard
  • Proving is medium
  • Fixing is easy

POV Information

Round Source Destination Result POV Analysis Video
18 CSDS CodeJitsu Failed POV POV Watch
18 CSDS DeepRed Failed POV POV Watch
18 CSDS Disekt Failed POV POV Watch
18 CSDS ForAllSecure Failed POV POV Watch
18 CSDS Shellphish Failed POV POV Watch
18 CSDS TECHx Failed POV POV Watch
18 DeepRed CodeJitsu Failed POV POV Watch
18 DeepRed CSDS Failed POV POV Watch
18 DeepRed Disekt Failed POV POV Watch
18 DeepRed ForAllSecure Failed POV POV Watch
18 DeepRed Shellphish Failed POV POV Watch
18 DeepRed TECHx Failed POV POV Watch
18 ForAllSecure CodeJitsu Failed POV POV Watch
18 ForAllSecure CSDS Failed POV POV Watch
18 ForAllSecure DeepRed Failed POV POV Watch
18 ForAllSecure Disekt Failed POV POV Watch
18 ForAllSecure Shellphish Failed POV POV Watch
18 ForAllSecure TECHx Failed POV POV Watch
19 CodeJitsu Disekt Failed POV through defenses POV Watch
19 CodeJitsu Shellphish Failed POV through defenses POV Watch
19 CSDS CodeJitsu Failed POV POV Watch
19 CSDS DeepRed Failed POV POV Watch
19 CSDS Disekt Failed POV through defenses POV Watch
19 CSDS ForAllSecure Failed POV POV Watch
19 CSDS Shellphish Failed POV through defenses POV Watch
19 CSDS TECHx Failed POV POV Watch
19 DeepRed CodeJitsu Failed POV POV Watch
19 DeepRed CSDS Failed POV POV Watch
19 DeepRed Disekt Failed POV through defenses POV Watch
19 DeepRed ForAllSecure Failed POV POV Watch
19 DeepRed Shellphish Failed POV through defenses POV Watch
19 DeepRed TECHx Failed POV POV Watch
19 ForAllSecure CodeJitsu Failed POV POV Watch
19 ForAllSecure CSDS Failed POV POV Watch
19 ForAllSecure DeepRed Failed POV POV Watch
19 ForAllSecure Disekt Failed POV through defenses POV Watch
19 ForAllSecure Shellphish Failed POV through defenses POV Watch
19 ForAllSecure TECHx Failed POV POV Watch
20 CSDS CodeJitsu Failed POV POV Watch
20 CSDS DeepRed Failed POV POV Watch
20 CSDS Disekt Failed POV through defenses POV Watch
20 CSDS ForAllSecure Failed POV POV Watch
20 CSDS Shellphish Failed POV through defenses POV Watch
20 CSDS TECHx Failed POV POV Watch
20 DeepRed CodeJitsu Failed POV POV Watch
20 DeepRed CSDS Failed POV POV Watch
20 DeepRed Disekt Failed POV through defenses POV Watch
20 DeepRed ForAllSecure Failed POV POV Watch
20 DeepRed Shellphish Failed POV through defenses POV Watch
20 DeepRed TECHx Failed POV POV Watch
20 ForAllSecure CodeJitsu Failed POV POV Watch
20 ForAllSecure CSDS Failed POV POV Watch
20 ForAllSecure DeepRed Failed POV POV Watch
20 ForAllSecure Disekt Failed POV through defenses POV Watch
20 ForAllSecure Shellphish Failed POV through defenses POV Watch
20 ForAllSecure TECHx Failed POV POV Watch
21 CSDS CodeJitsu Failed POV POV Watch
21 CSDS DeepRed Failed POV POV Watch
21 CSDS Disekt Failed POV through defenses POV Watch
21 CSDS ForAllSecure Failed POV POV Watch
21 CSDS Shellphish Failed POV through defenses POV Watch
21 CSDS TECHx Failed POV POV Watch
21 DeepRed CodeJitsu Failed POV POV Watch
21 DeepRed CSDS Failed POV POV Watch
21 DeepRed Disekt Failed POV through defenses POV Watch
21 DeepRed ForAllSecure Failed POV POV Watch
21 DeepRed Shellphish Failed POV through defenses POV Watch
21 DeepRed TECHx Failed POV POV Watch
21 ForAllSecure CodeJitsu Failed POV POV Watch
21 ForAllSecure CSDS Failed POV POV Watch
21 ForAllSecure DeepRed Failed POV POV Watch
21 ForAllSecure Disekt Failed POV through defenses POV Watch
21 ForAllSecure Shellphish Failed POV through defenses POV Watch
21 ForAllSecure TECHx Failed POV POV Watch
22 CSDS CodeJitsu Failed POV POV Watch
22 CSDS DeepRed Failed POV POV Watch
22 CSDS Disekt Failed POV through defenses POV Watch
22 CSDS ForAllSecure Failed POV POV Watch
22 CSDS Shellphish Failed POV through defenses POV Watch
22 CSDS TECHx Failed POV POV Watch
22 DeepRed CodeJitsu Failed POV POV Watch
22 DeepRed CSDS Failed POV POV Watch
22 DeepRed Disekt Failed POV through defenses POV Watch
22 DeepRed ForAllSecure Failed POV POV Watch
22 DeepRed Shellphish Failed POV through defenses POV Watch
22 DeepRed TECHx Failed POV POV Watch
22 ForAllSecure CodeJitsu Failed POV POV Watch
22 ForAllSecure CSDS Failed POV POV Watch
22 ForAllSecure DeepRed Failed POV POV Watch
22 ForAllSecure Disekt Failed POV through defenses POV Watch
22 ForAllSecure Shellphish Failed POV through defenses POV Watch
22 ForAllSecure TECHx Failed POV POV Watch
23 CSDS CodeJitsu Failed POV POV Watch
23 CSDS DeepRed Failed POV POV Watch
23 CSDS Disekt Failed POV through defenses POV Watch
23 CSDS ForAllSecure Failed POV POV Watch
23 CSDS Shellphish Failed POV through defenses POV Watch
23 CSDS TECHx Failed POV POV Watch
23 DeepRed CodeJitsu Failed POV POV Watch
23 DeepRed CSDS Failed POV POV Watch
23 DeepRed Disekt Failed POV through defenses POV Watch
23 DeepRed ForAllSecure Failed POV POV Watch
23 DeepRed Shellphish Failed POV through defenses POV Watch
23 DeepRed TECHx Failed POV POV Watch
23 ForAllSecure CodeJitsu Failed POV POV Watch
23 ForAllSecure CSDS Failed POV POV Watch
23 ForAllSecure DeepRed Failed POV POV Watch
23 ForAllSecure Disekt Failed POV through defenses POV Watch
23 ForAllSecure Shellphish Failed POV through defenses POV Watch
23 ForAllSecure TECHx Failed POV POV Watch
24 CSDS CodeJitsu Failed POV POV Watch
24 CSDS DeepRed Failed POV POV Watch
24 CSDS Disekt Failed POV through defenses POV Watch
24 CSDS ForAllSecure Failed POV POV Watch
24 CSDS Shellphish Failed POV through defenses POV Watch
24 CSDS TECHx Failed POV POV Watch
24 DeepRed CodeJitsu Failed POV POV Watch
24 DeepRed CSDS Failed POV POV Watch
24 DeepRed Disekt Failed POV through defenses POV Watch
24 DeepRed ForAllSecure Failed POV POV Watch
24 DeepRed Shellphish Failed POV through defenses POV Watch
24 DeepRed TECHx Failed POV POV Watch
24 ForAllSecure CodeJitsu Failed POV POV Watch
24 ForAllSecure CSDS Failed POV POV Watch
24 ForAllSecure DeepRed Failed POV POV Watch
24 ForAllSecure Disekt Failed POV through defenses POV Watch
24 ForAllSecure Shellphish Failed POV through defenses POV Watch
24 ForAllSecure TECHx Failed POV POV Watch
25 CSDS CodeJitsu Failed POV through defenses POV Watch
25 CSDS DeepRed Failed POV POV Watch
25 CSDS Disekt Failed POV through defenses POV Watch
25 CSDS ForAllSecure Failed POV POV Watch
25 CSDS Shellphish Failed POV through defenses POV Watch
25 CSDS TECHx Failed POV POV Watch
25 DeepRed CodeJitsu Failed POV through defenses POV Watch
25 DeepRed CSDS Failed POV POV Watch
25 DeepRed Disekt Failed POV through defenses POV Watch
25 DeepRed ForAllSecure Failed POV POV Watch
25 DeepRed Shellphish Failed POV through defenses POV Watch
25 DeepRed TECHx Failed POV POV Watch
25 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
25 ForAllSecure CSDS Failed POV POV Watch
25 ForAllSecure DeepRed Failed POV POV Watch
25 ForAllSecure Disekt Failed POV through defenses POV Watch
25 ForAllSecure Shellphish Failed POV through defenses POV Watch
25 ForAllSecure TECHx Failed POV POV Watch
26 CodeJitsu DeepRed Failed POV through defenses POV Watch
26 CSDS CodeJitsu Failed POV through defenses POV Watch
26 CSDS DeepRed Failed POV through defenses POV Watch
26 CSDS Disekt Failed POV through defenses POV Watch
26 CSDS ForAllSecure Failed POV POV Watch
26 CSDS Shellphish Failed POV through defenses POV Watch
26 CSDS TECHx Failed POV POV Watch
26 DeepRed CodeJitsu Failed POV through defenses POV Watch
26 DeepRed CSDS Failed POV POV Watch
26 DeepRed Disekt Failed POV through defenses POV Watch
26 DeepRed ForAllSecure Failed POV POV Watch
26 DeepRed Shellphish Failed POV through defenses POV Watch
26 DeepRed TECHx Failed POV POV Watch
26 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
26 ForAllSecure CSDS Failed POV POV Watch
26 ForAllSecure DeepRed Failed POV through defenses POV Watch
26 ForAllSecure Disekt Failed POV through defenses POV Watch
26 ForAllSecure Shellphish Failed POV through defenses POV Watch
26 ForAllSecure TECHx Failed POV POV Watch
27 CSDS CodeJitsu Failed POV through defenses POV Watch
27 CSDS DeepRed Failed POV through defenses POV Watch
27 CSDS Disekt Failed POV through defenses POV Watch
27 CSDS ForAllSecure Failed POV POV Watch
27 CSDS Shellphish Failed POV through defenses POV Watch
27 CSDS TECHx Failed POV POV Watch
27 DeepRed CodeJitsu Failed POV through defenses POV Watch
27 DeepRed CSDS Failed POV POV Watch
27 DeepRed Disekt Failed POV through defenses POV Watch
27 DeepRed ForAllSecure Failed POV POV Watch
27 DeepRed Shellphish Failed POV through defenses POV Watch
27 DeepRed TECHx Failed POV POV Watch
27 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
27 ForAllSecure CSDS Failed POV POV Watch
27 ForAllSecure DeepRed Failed POV through defenses POV Watch
27 ForAllSecure Disekt Failed POV through defenses POV Watch
27 ForAllSecure Shellphish Failed POV through defenses POV Watch
27 ForAllSecure TECHx Failed POV POV Watch
28 CSDS CodeJitsu Failed POV through defenses POV Watch
28 CSDS DeepRed Failed POV through defenses POV Watch
28 CSDS Disekt Failed POV through defenses POV Watch
28 CSDS ForAllSecure Failed POV POV Watch
28 CSDS Shellphish Failed POV through defenses POV Watch
28 DeepRed CodeJitsu Failed POV through defenses POV Watch
28 DeepRed CSDS Failed POV POV Watch
28 DeepRed Disekt Failed POV through defenses POV Watch
28 DeepRed ForAllSecure Failed POV POV Watch
28 DeepRed Shellphish Failed POV through defenses POV Watch
28 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
28 ForAllSecure CSDS Failed POV POV Watch
28 ForAllSecure DeepRed Failed POV through defenses POV Watch
28 ForAllSecure Disekt Failed POV through defenses POV Watch
28 ForAllSecure Shellphish Failed POV through defenses POV Watch
29 CodeJitsu DeepRed Failed POV POV Watch
29 CSDS CodeJitsu Failed POV through defenses POV Watch
29 CSDS DeepRed Failed POV POV Watch
29 CSDS Disekt Failed POV through defenses POV Watch
29 CSDS ForAllSecure Failed POV POV Watch
29 CSDS Shellphish Failed POV through defenses POV Watch
29 CSDS TECHx Failed POV through defenses POV Watch
29 DeepRed CodeJitsu Failed POV through defenses POV Watch
29 DeepRed CSDS Failed POV POV Watch
29 DeepRed Disekt Failed POV through defenses POV Watch
29 DeepRed ForAllSecure Failed POV POV Watch
29 DeepRed Shellphish Failed POV through defenses POV Watch
29 DeepRed TECHx Failed POV through defenses POV Watch
29 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
29 ForAllSecure CSDS Failed POV POV Watch
29 ForAllSecure DeepRed Failed POV POV Watch
29 ForAllSecure Disekt Failed POV through defenses POV Watch
29 ForAllSecure Shellphish Failed POV through defenses POV Watch
29 ForAllSecure TECHx Failed POV through defenses POV Watch
30 CSDS CodeJitsu Failed POV through defenses POV Watch
30 CSDS DeepRed Failed POV POV Watch
30 CSDS Disekt Failed POV through defenses POV Watch
30 CSDS ForAllSecure Failed POV POV Watch
30 CSDS Shellphish Failed POV through defenses POV Watch
30 CSDS TECHx Failed POV through defenses POV Watch
30 DeepRed CodeJitsu Failed POV through defenses POV Watch
30 DeepRed CSDS Failed POV POV Watch
30 DeepRed Disekt Failed POV through defenses POV Watch
30 DeepRed ForAllSecure Failed POV POV Watch
30 DeepRed Shellphish Failed POV through defenses POV Watch
30 DeepRed TECHx Failed POV through defenses POV Watch
30 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
30 ForAllSecure CSDS Failed POV POV Watch
30 ForAllSecure DeepRed Failed POV POV Watch
30 ForAllSecure Disekt Failed POV through defenses POV Watch
30 ForAllSecure Shellphish Failed POV through defenses POV Watch
30 ForAllSecure TECHx Failed POV through defenses POV Watch
31 CSDS CodeJitsu Failed POV through defenses POV Watch
31 CSDS DeepRed Failed POV POV Watch
31 CSDS Disekt Failed POV through defenses POV Watch
31 CSDS ForAllSecure Failed POV POV Watch
31 CSDS Shellphish Failed POV through defenses POV Watch
31 CSDS TECHx Failed POV through defenses POV Watch
31 DeepRed CodeJitsu Failed POV through defenses POV Watch
31 DeepRed CSDS Failed POV POV Watch
31 DeepRed Disekt Failed POV through defenses POV Watch
31 DeepRed ForAllSecure Failed POV POV Watch
31 DeepRed Shellphish Failed POV through defenses POV Watch
31 DeepRed TECHx Failed POV through defenses POV Watch
31 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
31 ForAllSecure CSDS Failed POV POV Watch
31 ForAllSecure DeepRed Failed POV POV Watch
31 ForAllSecure Disekt Failed POV through defenses POV Watch
31 ForAllSecure Shellphish Failed POV through defenses POV Watch
31 ForAllSecure TECHx Failed POV through defenses POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email