https://bugs.dpdk.org/show_bug.cgi?id=2033
Bug ID: 2033
Summary: pipeline: stack buffer overflow via strcat in spec
parsing
Product: DPDK
Version: 26.03
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: Normal
Component: other
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
[Overview]
A stack-based buffer overflow vulnerability exists in the DPDK pipeline library
during the parsing of pipeline specification (.spec) files. The functions
`action_block_parse()` and `apply_block_parse()` in
`lib/pipeline/rte_swx_pipeline_spec.c` concatenate tokens into a fixed-size
stack buffer without checking the accumulated length, leading to a memory
corruption or crash.
[Location]
- File: lib/pipeline/rte_swx_pipeline_spec.c
- Functions: `action_block_parse()` (lines 467-471) and `apply_block_parse()`
(lines 2155-2158)
- Buffer: `char buffer[RTE_SWX_INSTRUCTION_SIZE]` (256 bytes)
[Environment & Build]
- DPDK Version: [Please enter the scanned DPDK version here, e.g., 23.11 /
24.11 / main]
- OS / Kernel: Generic / Linux
- Tool: Identified via static analysis / manual code review.
[Vulnerability Logic & Analysis]
1. The specification file parser loop (lines 2903-2952) restricts individual
token lengths to less than 64 bytes (`strnlen(token, RTE_SWX_NAME_SIZE) >=
RTE_SWX_NAME_SIZE` triggers "Token too big").
2. However, there is no upper-bound validation on the total accumulated length
of `n_tokens` within a single line. The maximum tokens per line (`MAX_TOKENS`)
is 256, and the maximum line length (`MAX_LINE_LENGTH`) is 2048.
3. In `action_block_parse()` and `apply_block_parse()`, tokens are concatenated
into a 256-byte stack buffer using unbounded `strcat`:
```c
buffer = 0;
for (i = 0; i < n_tokens; i++) {
if (i)
strcat(buffer, " ");
strcat(buffer, tokens[i]);
}
```
4. Mathematical Proof: If a malicious or malformed .spec file contains a line
with 5 tokens, each 63 bytes long, the total concatenated length becomes: 5 *
63 + 4 (spaces) = 319 bytes.
5. This mathematically exceeds the 255-byte capacity (256 bytes minus 1 null
terminator) of the stack buffer, leading to a definite stack buffer overflow
when processing such a file.
[Actual Results]
No runtime crash has been triggered yet, but static analysis confirms an
unvalidated path leading to a stack-based out-of-bounds write (CVE-2024-11616),
causing potential memory corruption or application crash if an oversized .spec
file is loaded.
[Expected Results]
The token concatenation should safely handle string lengths, and the parser
should reject lines whose accumulated tokens exceed `RTE_SWX_INSTRUCTION_SIZE -
1`.
[Suggested Fix]
Replace the unbounded `strcat` with bounded string operations (`strncat` or
`snprintf`) that consider the remaining space in the destination buffer, for
example:
```c
buffer = 0;
for (i = 0; i < n_tokens; i++) {
if (i)
strncat(buffer, " ", sizeof(buffer) - strlen(buffer) - 1);
strncat(buffer, tokens[i], sizeof(buffer) - strlen(buffer) - 1);
}
```
Alternatively, add a pre-check validation on the total length before entering
the concatenation loop, and return an error if it exceeds the limit.
--
You are receiving this mail because:
You are the assignee for the bug.
