Description
I discovered a Denial of Service (DoS) vulnerability in the uci_import function. When processing a configuration line containing embedded null bytes (\x00) without a trailing newline, the parser enters an infinite loop or hangs significantly.
This causes performance degradation from ~20ms to over 20 seconds (or indefinite hang depending on memory/timeout), effectively blocking the process.
Steps to Reproduce
-
Download the Proof of Concept (PoC) file:
hang_id000003.bin
-
Run uci import with the malicious file:
# This command will hang/timeout
./uci import -f hang_id000003.bin
3. **Comparison:**
* Valid config processing time: ~20ms
* PoC processing time: >20s (Severe Hang)
### Root Cause Analysis
The issue is located in `file.c`, specifically around the buffer handling loop.
When `fgets()` reads a line containing null bytes, it includes them in the buffer. However, `strlen(p)` stops at the first null byte. As a result, the offset `ofs` is not incremented correctly to skip the full data read by `fgets`, causing the loop to process the same buffer segment repeatedly (or reallocate infinitely).
**Location:** `file.c` (approx line 66 in current master)
```c
// Current logic issue:
ofs += strlen(p); // stops at \x00, but buffer has more data
Impact
- DoS: Service startup delay or hang if malicious config files are present.
- Web/API: If
uci import is used to handle user-uploaded configurations (e.g., via LuCI or API), this could lead to a resource exhaustion attack.
Suggested Fix
Use strnlen or calculate the length based on the buffer size to ensure all characters (including embedded nulls) are processed or rejected.
// Proposed patch logic:
// Change from:
// ofs += strlen(p);
// To something like:
size_t len = strnlen(p, pctx->bufsz - ofs);
if (len == 0 && p[0] != '\0') {
uci_parse_error(ctx, "embedded null byte detected");
return;
}
ofs += len;Environment
- Project: openwrt/uci
- Version: Latest master
- Discovery Method: AFL++ Fuzzing
Description
I discovered a Denial of Service (DoS) vulnerability in the
uci_importfunction. When processing a configuration line containing embedded null bytes (\x00) without a trailing newline, the parser enters an infinite loop or hangs significantly.This causes performance degradation from ~20ms to over 20 seconds (or indefinite hang depending on memory/timeout), effectively blocking the process.
Steps to Reproduce
Download the Proof of Concept (PoC) file:
hang_id000003.bin
Run
uci importwith the malicious file:# This command will hang/timeout ./uci import -f hang_id000003.binImpact
uci importis used to handle user-uploaded configurations (e.g., via LuCI or API), this could lead to a resource exhaustion attack.Suggested Fix
Use
strnlenor calculate the length based on the buffer size to ensure all characters (including embedded nulls) are processed or rejected.Environment