4 ms·
This is a great writeup. However, even after also reading the CVE, I'm still unsure about under which circumstances you would be affected. As far as I understan
by deng 3y ago
This is a great writeup. However, even after also reading the CVE, I'm still unsure about under which circumstances you would be affected. As far as I understand it, you are affected if you
* use a SOCKS5 proxy, AND
* you use the SOCKS5 proxy to resolve hostnames (which AFAICS is NOT the default), AND
* the size of the buffer was changed from the default (100kb) to something below 65541 bytes, AND (EDIT: Not correct: 'libcurl' re-uses the download buffer for this, which by default is 16kB, however it is said that 'curl' itself sets it manually to 100kb UNLESS you use --limit-rate)
* the SOCKS5 proxy is too slow to handle the request immediately (which however, as the CVE states, can usually be provoked if the attacker has control over the request rate). (EDIT: This is wrong, the CVE actually says "Typical server latency is likely "slow" enough to trigger this bug without an attacker needing to influence it by DoS or SOCKS server control.")
So to me, the attack vector seems very small. Am I missing something?
- kiviuq 3y agoI'm trying to under the last comment > the SOCKS5 proxy is too slow to handle the request immediately the request seg faults immediately, no delays, no redirects root@1aac5e228e16:/build/curl-7.74.0# curl -vvv -x socks5h://host.docker.internal:9050 $(python3 -c "print(('A'10000), end='')") Trying 192.168.65.254:9050... * SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=10000] * SOCKS5 connect to AAAAA... * Send failure: Bad file descriptor * Failed to send SOCKS5 connect request. Segmentation fault https://gist.github.com/xen0bit/0dccb11605abbeb6021963e2b1a811d3 https://gist.github.com/xen0bit/0dccb11605abbeb6021963e2b1a8...
- deng 3y agoYes sorry, I was wrong. The CVE says the opposite, I put an EDIT in the OP.
- deng 3y agoI'm confused why plain 'curl' would crash here: the CVE says that "The target buffer is the heap-based download buffer in libcurl that is reused for SOCKS negotiation before the transfer has started. The size of the buffer is 16kB by default, but can be set to different sizes by the application. The curl tool sets it to 102400 bytes by default - but it sets the buffer size to a smaller size if --limit-rate is set lower than 102400 bytes per second." I thought with a buffer of 100kB, this bug wouldn't trigger?
- davidshepherd7 3y agoYeah I think this is correct with the edit. I guess this is mostly relevant for software that runs on shared infra, sends requests to a url provided by an attacker (e.g. webhooks), and uses a SOCKS5 proxy?
- nunez 3y agoI wrote a series of shell scripts called docker-proxy that creates SOCKS5 tunnels to Docker containers running openconnect VPNs, useful when you're working with multiple customers who have different VPNs that want all traffic on your machine forwarded through. https://github.com/carlosonunez/docker-proxy https://github.com/carlosonunez/docker-proxy Since DNS resolution is meant to occur remotely, this CVE would be directly applicable here.
- foul 3y agoTo me, this looks like recipe for disaster navigating in darknets like Tor.