Headline
CVE-2021-39929: OSS-Fuzz 39756: wireshark:fuzzshark_ip_proto-udp: Stack-overflow in dissect_bencoded_list (#17651) · Issues · Wireshark Foundation / wireshark · GitLab
Uncontrolled Recursion in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file
Skip to content
Open Issue created Oct 11, 2021 by Gerald Combs@geraldcombsOwner
OSS-Fuzz 39756: wireshark:fuzzshark_ip_proto-udp: Stack-overflow in dissect_bencoded_list
oss-fuzz found the following:
[Environment] UBSAN_OPTIONS=silence_unsigned_overflow=1
+----------------------------------------Release Build Stacktrace----------------------------------------+
Command: /mnt/scratch0/clusterfuzz/resources/platform/linux/unshare -c -n /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_wireshark_5b331c4a34b1622fa142778a49661cbb953bc75c/revisions/fuzzshark_ip_proto-udp -rss_limit_mb=2560 -timeout=60 -runs=100 /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/10f87f4bce2fcc49b3e9504e27290d69e61651586b6baf1c82a4ffa9f0fb0efc
Time ran: 0.3539454936981201
oss-fuzzshark: disabling: ip
oss-fuzzshark: disabling: udplite
oss-fuzzshark: disabling: ospf
oss-fuzzshark: disabling: bgp
oss-fuzzshark: disabling: dhcp
oss-fuzzshark: disabling: json
oss-fuzzshark: disabling: snort
oss-fuzzshark: configured for dissector: udp in table: ip.proto
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 67020306
INFO: Loaded 1 modules (501341 inline 8-bit counters): 501341 [0x55adf70, 0x56285cd),
INFO: Loaded 1 PC tables (501341 PCs): 501341 [0x56285d0,0x5dceba0),
/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_wireshark_5b331c4a34b1622fa142778a49661cbb953bc75c/revisions/fuzzshark_ip_proto-udp: Running 1 inputs 100 time(s) each.
Running: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/10f87f4bce2fcc49b3e9504e27290d69e61651586b6baf1c82a4ffa9f0fb0efc
UndefinedBehaviorSanitizer:DEADLYSIGNAL
==4046==ERROR: UndefinedBehaviorSanitizer: stack-overflow on address 0x7fff8f4f7fe8 (pc 0x0000005c2f44 bp 0x7fff8f4f8110 sp 0x7fff8f4f7ff0 T4046)
#0 0x5c2f44 in proto_tree_add_protocol_format wireshark/epan/proto.c:4301:2
#1 0x58384b in expert_create_tree wireshark/epan/expert.c:512:7
#2 0x58384b in expert_set_info_vformat wireshark/epan/expert.c:566:9
#3 0x583df3 in proto_tree_add_expert_internal wireshark/epan/expert.c:672:2
#4 0x9020cb in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:206:9
#5 0x90206e in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:195:16
#6 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#7 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#8 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#9 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#10 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#11 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#12 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#13 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#14 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#15 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#16 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#17 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#18 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#19 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#20 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#21 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#22 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#23 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#24 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#25 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#26 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#27 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#28 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#29 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#30 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#31 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#32 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#33 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#34 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#35 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#36 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#37 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#38 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#39 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#40 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#41 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#42 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#43 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#44 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#45 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#46 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#47 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#48 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#49 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#50 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#51 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#52 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#53 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#54 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#55 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#56 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#57 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#58 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#59 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#60 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#61 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#62 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#63 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#64 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#65 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#66 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#67 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#68 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#69 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#70 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#71 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#72 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#73 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#74 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#75 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#76 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#77 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#78 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#79 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#80 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#81 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#82 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#83 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#84 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#85 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#86 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#87 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#88 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#89 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#90 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#91 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#92 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#93 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#94 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#95 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#96 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#97 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#98 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#99 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#100 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#101 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#102 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#103 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#104 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#105 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#106 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#107 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#108 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#109 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#110 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#111 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#112 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#113 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#114 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#115 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#116 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#117 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#118 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#119 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#120 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#121 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#122 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#123 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#124 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#125 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#126 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#127 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#128 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#129 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#130 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#131 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#132 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#133 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#134 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#135 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#136 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#137 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#138 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#139 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#140 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#141 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#142 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#143 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#144 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#145 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#146 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#147 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#148 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#149 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#150 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#151 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#152 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#153 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#154 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#155 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#156 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#157 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#158 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#159 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#160 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#161 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#162 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#163 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#164 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#165 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#166 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#167 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#168 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#169 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#170 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#171 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#172 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#173 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#174 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#175 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
#176 0x901fae in dissect_bencoded_list wireshark/epan/dissectors/packet-bt-dht.c:199:16
#177 0x900f47 in dissect_bencoded_dict_entry wireshark/epan/dissectors/packet-bt-dht.c:426:16
#178 0x900f47 in dissect_bencoded_dict wireshark/epan/dissectors/packet-bt-dht.c:525:14
[ ... ]
clusterfuzz-testcase-fuzzshark_ip_proto-udp-6084351507431424.pcap
Edited Nov 15, 2021 by Gerald Combs
Related news
CVE-2023-4512: CBOR dissector Uncontrolled Recursion leading to Stack-Overflow | DoS (#19144) · Issues · Wireshark Foundation / Wireshark · GitLab
CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file