full-disclosure - [FD] Nosefart denial of service vulnerability

Open Source and information security mailing list archives

Message-ID: <6fdf2a1f.e44.15d92843056.Coremail.qflb.wu@dbappsecurity.com.cn>
Date: Sun, 30 Jul 2017 16:02:02 +0800 (GMT+08:00)
From: "qflb.wu" <qflb.wu@...ppsecurity.com.cn>
To: fulldisclosure@...lists.org
Subject: [FD] Nosefart denial of service vulnerability

Nosefart denial of service vulnerability
================
Author : qflb.wu
===============

Introduction:
=============
Nosefart is NES Music Player.Nosefart plays NSF (Nintendo Entertainment System Sound Format) files so you can listen to those old tunes without actually having to play through the games.

Affected version:
=====
2.9-mls

Vulnerability Description:
==========================
the chk_mem_access function in src/cpu/nes6502/nes6502.c in libnosefart.a in Nosefart 2.9-mls can  cause a denial of service(invalid memory read and application crash) via a crafted nsf file.

./nosefart nosefart_2.9-mls_invalid_memory_read.nsf

Program received signal SIGSEGV, Segmentation fault.
0x0000000000401940 in chk_mem_access (
    access=0x69752e <error: Cannot access memory at address 0x69752e>, flags=4)
    at src/cpu/nes6502/nes6502.c:1195
1195  uint8 oldchk = * access;
(gdb) bt
#0  0x0000000000401940 in chk_mem_access (
    access=0x69752e <error: Cannot access memory at address 0x69752e>, flags=4)
    at src/cpu/nes6502/nes6502.c:1195
#1  0x0000000000401ad6 in _bank_readbyte (address=61962, flags=4 '\004')
    at src/cpu/nes6502/nes6502.c:1265
#2  0x00000000004022c2 in nes6502_execute (remaining_cycles=29823)
    at src/cpu/nes6502/nes6502.c:1549
#3  0x0000000000408630 in nsf_inittune (nsf=0x6222a0) at src/machine/nsf.c:309
#4  0x0000000000409adb in nsf_playtrack (nsf=0x6222a0, track=1, 
    sample_rate=44100, sample_bits=8, stereo=0 '\000') at src/machine/nsf.c:997
#5  0x00000000004106ee in nsf_setupsong () at src/linux/main_linux.c:403
#6  0x0000000000410be9 in play (
    filename=0x622030 "/home/a/Documents/file", track=1, doautocalc=0, 
    reps=0, starting_frame=0, limited=0) at src/linux/main_linux.c:534
#7  0x0000000000411122 in main (argc=2, argv=0x7fffffffdfc8)
    at src/linux/main_linux.c:690
(gdb) 

POC:
nosefart_2.9-mls_invalid_memory_read.nsf
CVE:
CVE-2017-11119

===============================

qflb.wu () dbappsecurity com cn

Download attachment "poc.zip" of type "application/x-zip-compressed" (759 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives