Description
libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString() in lib/smi.c that allows attackers to overflow a fixed 1024-byte static buffer through hex rendering of OCTET STRING values. Attackers can supply a crafted MIB with an OCTET STRING DEFVAL of 512 or more octets and a leading 0x00 byte to corrupt adjacent library globals and crash smidump or other consumers.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
amartin755 libsmi
Default version status: unaffected
0 to ≤ 0.5.0affected
References
- https://hackmd.io/@haind-pwn/libsmi-smivalueasstring-octetstring-defval-oob-write ↗
- https://github.com/amartin755/libsmi/blob/c58307210fe995ec419db976eb234aebc71a9216/lib/smi.c#L479-L566 ↗
- https://github.com/amartin755/libsmi ↗
- https://www.vulncheck.com/advisories/libsmi-through-0.5.0-out-of-bounds-write-via-smivalueasstring-octet-string-defval ↗