New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.
Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Jun 2017
Cc:



Sign in to add a comment
link

Issue 1286: VMSF_DELTA filter in unrar allows arbitrary memory write

Reported by thomasdu...@google.com, Jun 9 2017

Issue description

It appears that the VMSF_DELTA memory corruption that was reported to Sophos AV in 2012 (and fixed there) was actually inherited from upstream unrar. For unknown reasons the information did not reach upstream rar or was otherwise lost, and the bug seems to have persisted there to this day.

The bug is sometimes called "Sophos Anti-Virus RAR VMSF_DELTA Filter Signedness Error", and referenced in the following links:
   https://community.sophos.com/kb/en-us/118424#six
   http://telussecuritylabs.com/threats/show/TSL20121207-01

The issue is in the following code:

    case VMSF_DELTA:
      {
        int DataSize=R[4],Channels=R[0],SrcPos=0,Border=DataSize*2;
        if ((uint)DataSize>=VM_MEMSIZE/2)
          break;

        // Bytes from same channels are grouped to continual data blocks,
        // so we need to place them back to their interleaving positions.
        for (int CurChannel=0;CurChannel<Channels;CurChannel++)
        {
          byte PrevByte=0;
          for (int DestPos=DataSize+CurChannel;DestPos<Border;DestPos+=Channels)
            Mem[DestPos]=(PrevByte-=Mem[SrcPos++]);
        }
      }
      break;

An attacker controls R[4] and R[0] arbitrarily. By setting R[0] to be sufficiently
large (perhaps 0x7FFFFFFF), an integer overflow can be caused in DataSize+CurChannel.
The result is a negative value of "DestPos", which allows the attacker to write 
out of bounds when setting Mem[DestPos].

A minimal test example that crashes unrar 5.40 and prior is base64-encoded below:

Base64-encoded RAR file to trigger the VMSF_DELTA issue:

UmFyIRoHAPlOcwAADgAAAAAAAAAAMAh0AAAmAI4AAAAAAAAAAhBBUiEAAAAAHQAGAAAAACBzdGRv
dXQgIVUMzRDNmBGByDAda+AXaSv4KvQr1K/oejL05mXmXmww5tEk8gA9k8nmieyeyeswuOR6cx69
a2Hd6zQwu3aoMDDwMEswADAAMD4P938w+dydoRFwAmwAAAAAvv////+/////+9W3QFgAAQAGAAAA
Ooimhd12AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Given the wide prevalence of the unrar source code in third-party software, quite a few
downstream parties will be affected. The source code with the fixes can be found
under http://www.rarlab.com/rar/unrarsrc-5.5.5.tar.gz - downstream parties are
encouraged to quickly update and ship fixes.

Thanks to the RAR developers for their quick turnaround and helpful proactive audit
of their codebase which removed further issues.

This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.
 

Comment 1 by thomasdu...@google.com, Jun 19 2017

The RAR developers analyzed the entire rarvm.cpp and found / fixed other issues along with this issue. All users of unrar, and third-party developers that statically link to unrar, are strongly encouraged to update quickly.

Comment 2 by thomasdu...@google.com, Jun 20 2017

Description: Show this description

Comment 3 by thomasdu...@google.com, Jun 20 2017

Description: Show this description

Comment 4 by thomasdu...@google.com, Jun 20 2017

Description: Show this description

Comment 5 by thomasdu...@google.com, Jun 20 2017

Description: Show this description

Comment 6 by thomasdu...@google.com, Jun 20 2017

Description: Show this description

Comment 7 by thomasdu...@google.com, Jun 20 2017

Labels: -Restrict-View-Commit

Comment 8 by thomasdu...@google.com, Jun 20 2017

Status: Fixed (was: New)

Sign in to add a comment