"Ben Schmidt" info@narfindustries.com
Narf Industries (NRFIN)
Making passwords is hard. Managing passwords is even harder. So let us do it for you! With EternalPass, you'll only ever need to remember one password, and we'll make the rest for you!
A very simple vulnerability involving use of an unchecked function pointer, directly provided by the user, in the password generation function. This function is passed a user-provided seed, which is fully controlled by the user. The only caveat is that the function pointer must be decimal encoded and greater than 0x08000000.
Untrusted pointer use
CWE-822 Untrusted pointer dereference
Almost identical to the first vulnerability, but the user no longer directly controls any arguments in the vulnerable function pointer call. It is possible, however, to successfully control a register using the highest byte of each of four subsequent calls to CRC32 on dynamically generated strings (which they can select, but do not control). Alternatively, it may be possible to solve this by jumping to various useful gadgets in the binary.
Untrusted pointer use
CWE-822 Untrusted pointer dereference
Curated by Lunge Technology, LLC. Questions or comments? Send us email