漏洞细节

static int der_match_tag_and_length(const unsigned char *p, size_t len, Der_class xclass,                          Der_type type, int tag, size_t *length_ret,                          size_t *size) {     size_t l, ret = 0;     int e;      e = der_match_tag(p, len, xclass, type, tag, &l);     if (e) {         return (e);     }     p += l;     len -= l;     ret += l;     e = der_get_length(p, len, length_ret, &l);  // (1)     if (e) {         return (e);     }     /* p += l; */     len -= l;     POST(len);     ret += l;     if (size) {         *size = ret;     }     return (0); }

OM_uint32 gss_accept_sec_context_spnego(...) { // ...     ret = der_match_tag_and_length(buf, buf_size, ASN1_C_CONTEXT, CONS, 0,                                    &len, &taglen);     if (ret) {         return (ret);     }      ret = decode_NegTokenInit(buf + taglen, len, &init_token, &ni_len);  // (2) // ... }

触发机制

# cat /etc/bind/named.conf.options options {     directory "/var/cache/bind";     tkey-gssapi-keytab "/etc/bind/dns.keytab"; };  # cat /etc/bind/named.conf.local zone "example.nil." IN {     type master;     file "/etc/bind/example.nil.db"; };

#0  __memmove_avx_unaligned_erms at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:494 #1  der_get_octet_string at spnego.c:830 #2  decode_octet_string at spnego.c:1015 #3  decode_NegTokenInit at spnego_asn1.c:607 #4  gss_accept_sec_context_spnego at spnego.c:593 #5  dst_gssapi_acceptctx at gssapictx.c:730 #6  process_gsstkey at tkey.c:551 #7  dns_tkey_processquery at tkey.c:882 #8  ns_query_start at query.c:11653 #9  ns__client_request at client.c:2169 #10 isc__nm_async_readcb at netmgr.c:1861 #11 isc__nm_readcb at netmgr.c:1836 #12 processbuffer at tcpdns.c:997 #13 process_sock_buffer at tcpdns.c:1639 #14 read_cb at tcpdns.c:1060

漏洞利用

OM_uint32 gss_accept_sec_context_spnego(...) { // ...     ret = decode_NegTokenInit(buf + taglen, len, &init_token, &ni_len);     if (ret) {         *minor_status = EINVAL; /* XXX */         return (GSS_S_DEFECTIVE_TOKEN);     }      for (i = 0; !found && i < init_token.mechTypes.len; ++i) { // (3)         unsigned char mechbuf[17];         size_t mech_len;          ret = der_put_oid(mechbuf + sizeof(mechbuf) - 1,                           sizeof(mechbuf), &init_token.mechTypes.val[i],                           &mech_len);         if (ret) {             free_NegTokenInit(&init_token);             return (GSS_S_DEFECTIVE_TOKEN);         }         if (mech_len == GSS_KRB5_MECH->length &&                 isc_safe_memequal(GSS_KRB5_MECH->elements,                                   mechbuf + sizeof(mechbuf) - mech_len,                                   mech_len))         {             found = 1;             break;         }         if (mech_len == GSS_MSKRB5_MECH->length &&                 isc_safe_memequal(GSS_MSKRB5_MECH->elements,                                   mechbuf + sizeof(mechbuf) - mech_len,                                   mech_len))         {             found = 1;             if (i == 0) {                 pref = GSS_MSKRB5_MECH;             }             break;         }     }      if (!found) {         free_NegTokenInit(&init_token);         return (send_reject(minor_status, output_token)); // (5)     } // ... ret = send_accept(&minor_status2, output_token, ot, pref);  // (4) // ... }

总结