dilan-diaz/point-to-point-protocol-daemon-rce-vulnerability-cve-2020-8597-University assignment documenting CVE-2020-8597, a stack buffer overflow in pppd's EAP parser, with a remote code execution exploit demonstration using a pppoe-server and client setup.
Sri Lanka Institute of Information Technology
Assignment 1
M. P. D. M. Dias
IT19165530
MLB_WD_Y2S1_13.1
Point to Point Protocol Daemon RCE
Vulnerability (CVE-2020-8597)
Systems and Network Programming– IE2012
Content
Introduction
The Point-to-Point Protocol (PPP) is a full-duplex protocol that allows simple data to be encapsulated and distributed through Layer 2 or data-link infrastructure spanning from dial-up connectivity through DSL broadband to virtual private networks (VPNs) incorporating SSL encryption. As these protocols do not allow point-to-point communications, PPP is also used to enforce IP and TCP over two directly connected nodes. Pppd is a daemon used on Unix-like operating systems to manage the establishment of PPP sessions and the termination of sessions between two nodes.
PPP is the protocol used to create internet connections over dial-up modems, DSL connections, and several other forms of point-to-peer connections via Virtual Private Networks (VPN), such as Peer to Point Tunneling Protocol (PPTP). The pppd program can also authenticate a peer connecting to the network and/or provide the peer with authentication details utilizing various authentication protocols like EAP.
Due to a flaw in the Point-to-Point Protocol Daemon (pppd) handling of the Extensible Authentication Protocol (EAP) packet, an unauthenticated remote attacker may cause a stack buffer overflow which may allow arbitrary execution of code on the target system. This weakness is triggered by an mistake in validating the input size before copying the data supplied to memory. Provided that the validity of the data size is wrong, random data may be copied into memory which can trigger file leakage contributing to unintended code execution.
The weakness lies in the eap parsing code logic, explicitly in the eap request) (and eap response) (functions in eap.c that a network input handler calls. These functions, using the first byte as a type, take a pointer and length as input. If the form is EAPT MD5CHAP(4), then it looks at an embedded area of 1-byte length. The rationale in this code is intended to make sure embedded duration is less than the total length of the packet. Following this verification, it tries to copy the provided data (hostname), which is located in a local stack buffer after the embedded length field. This boundary check is incorrect and allows memory copying to occur with an arbitrary data length.
An additional logical error causes the eap input) (function not to test whether EAP has been resolved during the Line Control Protocol (LCP) process. This allows an unauthenticated attacker to send an EAP packet even if ppp refused to negotiate authentication due to lack of support for EAP or due to a non-compliance with an agreed pre-shared passphrase in the LCP stage. In eap input the insecure pppd code must still process the EAP packet and cause the stack buffer overflow. This unverified, unknown-size data can be used to compromise goal device memory. The pppd also runs with high privileges (system or root), and operates with kernel drivers in tandem.
The pppd program is also used with the LWIP (lightweight IP) project to provide pppd capability with tiny computers. The default lwIP installation and installations are not susceptible to this buffer overload. However, if used the lwIP source code and modified it explicitly to allow EAP at compile time, the program can be susceptible to buffer overflow.
CVE-2020-8597 is a buffer overflow bug in pppd owing to a conceptual defect in the Extensible Authentication Protocol (EAP) packet processor. An unauthorized remote attacker who sends a specially crafted EAP packet to a vulnerable PPP client or server may cause a denial of service condition or an arbitrary code execution. As pppd operates in tandem with kernel drivers and also has high privileges, such as device or even core, any code execution may also be performed with the same privileges.
Referenced on who found the vulnerability
Discovered by IOActive Protection Researcher Ilja Van Sprundel, the crucial problem is a stack buffer overflow flaw that occurs due to a logical error in the Extensible Authentication Protocol (EAP) module parser of pppd applications, an enhancement that offers support for additional authentication methods in PPP connections.
The weakness, monitored as CVE-2020-8597 with CVSS Score 9.8, can be abused by unauthorized attackers to remotely execute arbitrary code on affected devices and gain complete control of them.
How it was found
This weakness is attributed to an mistake in validating the size of the input before transferring the data to memory. Because data size validation is wrong, random data can be copied to memory and can trigger database fragmentation, likely contributing to the execution of unauthorized code.
The vulnerability is found in the logic of the eap parsing code, specifically in eap request) (and eap response) (functions in eap.c, which are called by the network input handler.
It is wrong to conclude that pppd is not insecure if EAP is not allowed or if EAP has not been initiated by a remote peer using a password or passphrase. This is because an authenticated intruder may always be able to submit an unsolicited EAP packet to induce a buffer overflow.
The vulnerability has been identified in the Point-to-Point Protocol (PPP) daemon, or pppd. PPP is a Layer 2 protocol used to establish connections over dial-up modems, DSL connections, and many other physical networks, including mobile networks. PPP has been included in and expanded to include additional protocols, such as the Point-to-Point Tunneling Protocol (PPTP) that is used in Virtual Private Networks (VPNs) to provide encrypted connections.
Throughout this situation, the SEI CERT collaboration team partnered with protection analyst Ilja Van Sprundel (IOActive) who found this flaw and software developer Paul Mackerras (OZlabs) who manages the source code to easily examine the issue and find a workaround. The issue involved a buffer overflow in the pppd source code owing to a basic buffer overflow in the Boolean expression and the implementation of the conditional statements that resulted. The sentence below can be fooled into allowing unknown duration feedback and copying it to a stack buffer. That is commonly referred to as frame overload or stack buffer overflow.
if (vallen >= len + sizeof(rhostname)) { // Copy to buffer rhostname
The fix for the vulnerability was to simply change the above statement to the Boolean logic below.
if (len-vallen >= sizeof(rhostname)) { // Copy to buffer rhostname
Paul issued CVE-2020-8597 for this flaw and continued to repair it to the source code he managed. The system update required to correct the bug is a minor one that requires just a few lines of code. Nevertheless, this insecure technology resides in thousands of libraries of software projects. It has been adopted by more than 100 companies offering network access devices spanning from home routers to business network hardware. As this weakness affects all PPP clients and servers, it also affects Internet Service Providers (ISPs).
When it was found
On 2020 March 4, researchers at the CERT Coordination Center (CERT / CC) published vulnerability note # 782301 for critical vulnerability in Point-to-Point Protocol Daemon (pppd) versions 2.4.2 through 2.4.8, with disclosure credited to IOActive's Ilja van Sprundel.