## Basic information **Project name:** Eclipse Mosquitto **Project id:** mosquitto.org **Request type:** publication **Versions affected:** [v2.0.18-4-g15292b20] **Common Weakness Enumeration:** - [CWE-122: Heap-based Buffer Overflow](https://cwe.mitre.org/data/definitions/122.html) **Common Vulnerability Scoring System:** - **Summary:** In Eclipse Mosquitto version v2.0.18-4-g15292b20, a heap-buffer-overflow vulnerability was discovered that can be triggered when the broker processes a specially crafted packet. This vulnerability exists due to a boundary error within the `my_subscribe_callback` function in the `sub_client.c` file, which can lead to code execution or denial of service. **Links:** The project at "https://github.com/eclipse/mosquitto" advises against posting discovered bugs directly in the issues section and instead requests the submission of details via the form at "https://gitlab.eclipse.org/security". I apologize for any inconvenience, and so I have documented the method for reproducing the issue here. **Reproduce：** 1. Configure the building environment with ASan and UBSan by setting the environment variables for the compiler and linker: ```bash export CC=clang CXX=clang++ export CFLAGS="-g -fsanitize=address,undefined -fno-omit-frame-pointer" export CXXFLAGS="-g -fsanitize=address,undefined -fno-omit-frame-pointer" export LDFLAGS="-fsanitize=address,undefined" make clean make -j 8 ``` 2. Start the Mosquitto broker server in verbose mode on port 2883: ```bash mosquitto/src/mosquitto -v -p 2883 ``` 3. Write the data transmission from the proxy to the client using a series of hexstream found in `hexstream.txt`: [hexstream.txt](/uploads/abdd422fd21616901eff5f58b225ca65/hexstream.txt) **Crash Report：** Here is the client log： ``` Run topic: test/tp Run sub(Qos0) in topic [test/tp] Run sub(Qos1) in topic [test/tp] Run sub(Qos2) in topic [test/tp] Run sub(Qos2) in topic [test/#] Run Qos1 sub in topic [test/chat] with qos2 will Hit CTRL+C test/tp qos2 test/tp qos2 test/tp qos2 test/tp qos2 ``` Here is the ASan reprot: ``` Error: Unknown error. Error: The connection was lost. ================================================================= Error: A network protocol error occurred when communicating with the broker. ==1400134==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000210 at pc 0x0000004cb0c8 bp 0x7ffeee2abd60 sp 0x7ffeee2abd58 READ of size 4 at 0x602000000210 thread T0 #0 0x4cb0c7 in my_subscribe_callback mosquitto/client/sub_client.c:150:27 #1 0x7fb53b7b9b3f in handle__suback mosquitto/lib/handle_suback.c:102:3 #2 0x7fb53b80512f in handle__packet mosquitto/lib/read_handle.c:59:11 #3 0x7fb53b7f274a in packet__read mosquitto/lib/packet_mosq.c:566:7 #4 0x7fb53b7c21f1 in mosquitto_loop_read mosquitto/lib/loop.c:380:9 #5 0x7fb53b7c0966 in mosquitto_loop mosquitto/lib/loop.c:149:10 #6 0x7fb53b7c2785 in mosquitto_loop_forever mosquitto/lib/loop.c:257:9 #7 0x4ca20c in main mosquitto/client/sub_client.c:404:7 #8 0x7fb53b3c60b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16 #9 0x41d76d in _start (mosquitto/client/mosquitto_sub+0x41d76d) 0x602000000211 is located 0 bytes to the right of 1-byte region [0x602000000210,0x602000000211) allocated by thread T0 here: #0 0x4989aa in malloc /home/brian/src/llvm_releases/llvm-project/llvm/utils/release/final/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 SUMMARY: AddressSanitizer: heap-buffer-overflow mosquitto/client/sub_client.c:150:27 in my_subscribe_callback Shadow bytes around the buggy address: 0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c047fff8000: fa fa 00 07 fa fa 00 fa fa fa 00 02 fa fa 00 fa 0x0c047fff8010: fa fa 00 02 fa fa 00 02 fa fa 00 fa fa fa 00 01 0x0c047fff8020: fa fa 00 02 fa fa 00 00 fa fa fd fd fa fa fd fd 0x0c047fff8030: fa fa 00 00 fa fa fd fa fa fa fd fd fa fa 02 fa =>0x0c047fff8040: fa fa[01]fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==1400134==ABORTING Error: The connection was lost. ``` ## Tracking **This section will completed by the project team**. - [ ] Reserve an entry only - [ ] We're ready for this issue to be reported to the central authority (i.e., make this public now) - [ ] (when applicable) The GitHub Security Advisory is ready to be published now Note that for those projects that host their repositories on GitHub, the use of GitHub Security Advisories is recommended but is not required. **This section will be completed by the EMO**. **CVE:** {cve} - [ ] All required information is provided - [ ] CVE Assigned - [ ] Pushed to Mitre - [ ] Accepted by Mitre /assign @mbarbero @mrybczyn