I'll investigate the sip_get_callid function in the binary for potential vulnerabilities.
Function ghidra_open_server called with arguments: {"filepath": "/sandbox/sngrep_4", "reopen": true}
Tool result
[
{
"type": "text",
"text": "Success"
}
]Function ghidra_search_functions_by_name called with arguments: {"filepath": "/sandbox/sngrep_4", "query": "sip_get_callid"}
Tool result
[
{
"type": "text",
"text": "sip_get_callid @ 0010bf80"
}
]Function ghidra_decompile_function called with arguments: {"filepath": "/sandbox/sngrep_4", "name_or_address": "sip_get_callid"}
Tool result
[
{
"type": "text",
"text": "\nchar * sip_get_callid(char *payload,char *callid)\n\n{\n long lVar1;\n int iVar2;\n size_t __n;\n long in_FS_OFFSET;\n regmatch_t pmatch [3];\n \n lVar1 = *(long *)(in_FS_OFFSET + 0x28);\n if ((payload == (char *)0x0) || (callid == (char *)0x0)) {\n callid = (char *)0x0;\n goto LAB_0010bfd0;\n }\n iVar2 = regexec((regex_t *)&calls.reg_callid,payload,3,(regmatch_t *)pmatch,0);\n if (iVar2 == 0) {\n iVar2 = pmatch[2].rm_eo - pmatch[2].rm_so;\n if (iVar2 < 0x800) {\n __n = (size_t)iVar2;\n if (iVar2 < 1) goto LAB_0010bfca;\n }\n else {\n __n = 0x7ff;\n }\n strncpy(callid,payload + pmatch[2].rm_so,__n);\n callid[__n] = '\\0';\n }\n else {\nLAB_0010bfca:\n *callid = '\\0';\n }\nLAB_0010bfd0:\n if (lVar1 != *(long *)(in_FS_OFFSET + 0x28)) {\n /* WARNING: Subroutine does not return */\n __stack_chk_fail();\n }\n return callid;\n}\n\n"
}
]Function ghidra_disassemble_function called with arguments: {"filepath": "/sandbox/sngrep_4", "address": "0010bf80"}
Tool result
[
{
"type": "text",
"text": "0010bf80: ENDBR64 "
},
{
"type": "text",
"text": "0010bf84: PUSH R12 "
},
{
"type": "text",
"text": "0010bf86: PUSH RBP "
},
{
"type": "text",
"text": "0010bf87: PUSH RBX "
},
{
"type": "text",
"text": "0010bf88: SUB RSP,0x20 "
},
{
"type": "text",
"text": "0010bf8c: MOV RAX,qword ptr FS:[0x28] "
},
{
"type": "text",
"text": "0010bf95: MOV qword ptr [RSP + 0x18],RAX "
},
{
"type": "text",
"text": "0010bf9a: XOR EAX,EAX "
},
{
"type": "text",
"text": "0010bf9c: TEST RDI,RDI "
},
{
"type": "text",
"text": "0010bf9f: JZ 0x0010c020 "
},
{
"type": "text",
"text": "0010bfa1: MOV RBX,RSI "
},
{
"type": "text",
"text": "0010bfa4: TEST RSI,RSI "
},
{
"type": "text",
"text": "0010bfa7: JZ 0x0010c020 "
},
{
"type": "text",
"text": "0010bfa9: MOV R12,RDI "
},
{
"type": "text",
"text": "0010bfac: XOR R8D,R8D "
},
{
"type": "text",
"text": "0010bfaf: MOV RSI,RDI "
},
{
"type": "text",
"text": "0010bfb2: MOV RCX,RSP "
},
{
"type": "text",
"text": "0010bfb5: MOV EDX,0x3 "
},
{
"type": "text",
"text": "0010bfba: LEA RDI,[0x1388a8] "
},
{
"type": "text",
"text": "0010bfc1: CALL 0x00107fc0 "
},
{
"type": "text",
"text": "0010bfc6: TEST EAX,EAX "
},
{
"type": "text",
"text": "0010bfc8: JZ 0x0010bff0 "
},
{
"type": "text",
"text": "0010bfca: MOV byte ptr [RBX],0x0 "
},
{
"type": "text",
"text": "0010bfcd: MOV RAX,RBX "
},
{
"type": "text",
"text": "0010bfd0: MOV RDX,qword ptr [RSP + 0x18] "
},
{
"type": "text",
"text": "0010bfd5: SUB RDX,qword ptr FS:[0x28] "
},
{
"type": "text",
"text": "0010bfde: JNZ 0x0010c02f "
},
{
"type": "text",
"text": "0010bfe0: ADD RSP,0x20 "
},
{
"type": "text",
"text": "0010bfe4: POP RBX "
},
{
"type": "text",
"text": "0010bfe5: POP RBP "
},
{
"type": "text",
"text": "0010bfe6: POP R12 "
},
{
"type": "text",
"text": "0010bfe8: RET "
},
{
"type": "text",
"text": "0010bff0: MOVSXD RDX,dword ptr [RSP + 0x10] "
},
{
"type": "text",
"text": "0010bff5: MOV EAX,dword ptr [RSP + 0x14] "
},
{
"type": "text",
"text": "0010bff9: SUB EAX,EDX "
},
{
"type": "text",
"text": "0010bffb: CMP EAX,0x7ff "
},
{
"type": "text",
"text": "0010c000: JG 0x0010c028 "
},
{
"type": "text",
"text": "0010c002: MOVSXD RBP,EAX "
},
{
"type": "text",
"text": "0010c005: TEST EAX,EAX "
},
{
"type": "text",
"text": "0010c007: JLE 0x0010bfca "
},
{
"type": "text",
"text": "0010c009: LEA RSI,[R12 + RDX*0x1] "
},
{
"type": "text",
"text": "0010c00d: MOV RDI,RBX "
},
{
"type": "text",
"text": "0010c010: MOV RDX,RBP "
},
{
"type": "text",
"text": "0010c013: CALL 0x001086c0 "
},
{
"type": "text",
"text": "0010c018: MOV byte ptr [RBX + RBP*0x1],0x0 "
},
{
"type": "text",
"text": "0010c01c: JMP 0x0010bfcd "
},
{
"type": "text",
"text": "0010c020: XOR EAX,EAX "
},
{
"type": "text",
"text": "0010c022: JMP 0x0010bfd0 "
},
{
"type": "text",
"text": "0010c028: MOV EBP,0x7ff "
},
{
"type": "text",
"text": "0010c02d: JMP 0x0010c009 "
},
{
"type": "text",
"text": "0010c02f: CALL 0x00108550 "
}
]Vulnerability Analysis: sip_get_callid
VULNERABILITY IDENTIFIED: Off-by-One Buffer Overflow
Technical Details:
Location: Lines handling buffer size calculation and null termination
__n = (size_t)iVar2; // iVar2 can be up to 0x7ff (2047)
strncpy(callid, payload + pmatch[2].rm_so, __n);
callid[__n] = '\0'; // VULNERABILITY: writes at callid[2047] if __n=0x7ff
Vulnerability Type: CWE-193 (Off-by-One Error)
Root Cause:
- Buffer size check:
if (iVar2 < 0x800)allows sizes up to 0x7ff (2047 bytes) - The null terminator is written at
callid[__n], which exceeds buffer bounds when__n = 0x7ff - For a buffer of size 0x800 (2048), valid indices are 0-2047, but the null byte at index 2047 assumes the buffer can hold 2048 bytes PLUS null terminator
Attack Scenario:
- Attacker crafts SIP packet with Call-ID exactly 2047 bytes long
strncpycopies 2047 bytes intocallidbuffer (indices 0-2046)- Null terminator written at
callid[2047]- one byte past allocated buffer - Overwrites adjacent memory (potential for stack corruption, heap metadata corruption)
CVSS Score: 7.5 (High)
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- Impact: Memory corruption leading to potential DoS or code execution
Mitigation:
if (iVar2 < 0x800) {
__n = (size_t)iVar2;
} else {
__n = 0x7ff; // Should be 0x7fe to leave room for null terminator
}