Analysis of CVE-2022-23093 (FreeBSD Ping Stack Overflow)

We can now make a copy of the ping.c file and open it with an advanced editor such as VSCode. This way, we will acknowledge what is useful and what is not.

At this point, the best thing we can do is starting from the end and moving backwards to the beginning. In this specific case, we are moving from the pr_pack() fuction to the main(). This method ensures that we are reaching the vulnerable code by analyzing what is worth, and nothing more.

First, we scroll down to reach the pr_pack() function and, for now, we erase all the content underneath the vulnerable code, and all that is found above it and does not affect the data or the control flows. This means that the whole pr_pack() function is now resized from ~300 lines of code to this:

static void
pr_pack(char *buf, ssize_t cc, struct sockaddr_in *from, struct timespec *tv)
{
	u_char l;
	struct ip ip;
	int hlen;

	memcpy(&l, buf, sizeof(l));
	hlen = (l & 0x0f) << 2;
	memcpy(&ip, buf, hlen);
}

So, ito reach the vulnerable code, it is now sufficient to invoke the pr_pack() function, without worrying about other conditions, data edits or other issues that would make the analysis and the exploit far more complex.

The next step is finding all the parts in the code that invoke the pr_pack() function. To do so, you can just search for the name of the function. Otherwise, you can hold CTRL and click on the name of the function to make VSCode highlight all the occurrences.

In this case, the function is invoked just once in the main() function, at the line no. 958. This means that we will have to analyze just ~700 lines of code, hence half of the original total amount.

int
main(int argc, char *const *argv)
{
   pr_pack((char *)packet, cc, &from, tv);

At this point, we must consider that when using ping, we will launch the ping -c 1 <target ip> command to limit the number of ICMP echo-request packets sent to 1. This information is essential, since we will now get back to the beginning of the main() function and erase all that is not strictly related to invoking the pr_pack()function. This means erasing all the code that is used when launching the command with other flags (excluding -c 1), the error handling (we assume that we will encounter no errors) and all the variables that we cannot control or that are not used when invoking the vulnerable function.

This is the result that we propose:

int
main(int argc, char *const *argv)
{
	struct sockaddr_in from, sock_in;
	struct timespec last, intvl;
	struct iovec iov;
	struct msghdr msg;
	char *ep, *source, *target, *payload;
	struct sockaddr_in *to;
	u_long alarmtimeout;
	long ltmp;
	int almost_done, ch, df, hold, i, icmp_len, mib[4], preload;
	int ssend_errno, srecv_errno, tos, ttl;
	char ctrl[CMSG_SPACE(sizeof(struct timespec))];

	payload = source = NULL;

	cap_rights_t rights;
	bool cansandbox;

	options |= F_NUMERIC;

	ssend = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
	srecv = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);

	alarmtimeout = df = preload = tos = 0;

	outpack = outpackhdr + sizeof(struct ip);
	while ((ch = getopt(argc, argv, "Aac:DdfG:g:h:I:i:Ll:M:m:nop:QqRrS:s:T:t:vW:z:")) != -1)
	{
		switch(ch) {
		case 'c':
			ltmp = strtol(optarg, &ep, 0);
			npackets = ltmp;
			break;
		}
	}

	target = argv[optind];

	icmp_len = sizeof(struct ip) + ICMP_MINLEN + phdr_len;

	send_len = icmp_len + datalen;
	datap = &outpack[ICMP_MINLEN + phdr_len + TIMEVAL_LEN];
	
	bzero(&whereto, sizeof(whereto));
	to = &whereto;
	to->sin_family = AF_INET;
	to->sin_len = sizeof *to;
	if (inet_aton(target, &to->sin_addr) != 0) {
		hostname = target;
	}

	/* From now on we will use only reverse DNS lookups. */
	if (connect(ssend, (struct sockaddr *)&whereto, sizeof(whereto)) != 0)
		err(1, "connect");

	if (!(options & F_PINGFILLED))
		for (i = TIMEVAL_LEN; i < datalen; ++i)
			*datap++ = i;

	ident = getpid() & 0xFFFF;

	hold = 1;

	if (options & F_NUMERIC)
		cansandbox = true;

	hold = IP_MAXPACKET + 128;
	(void)setsockopt(srecv, SOL_SOCKET, SO_RCVBUF, (char *)&hold, sizeof(hold));

	if (uid == 0)
		(void)setsockopt(ssend, SOL_SOCKET, SO_SNDBUF, (char *)&hold, sizeof(hold));

	if (to->sin_family == AF_INET) {
		(void)printf("PING %s (%s)", hostname, inet_ntoa(to->sin_addr));
		(void)printf(": %d data bytes\n", datalen);

	}

	bzero(&msg, sizeof(msg));
	msg.msg_name = (caddr_t)&from;
	msg.msg_iov = &iov;
	msg.msg_iovlen = 1;
#ifdef SO_TIMESTAMP
	msg.msg_control = (caddr_t)ctrl;
	msg.msg_controllen = sizeof(ctrl);
#endif
	iov.iov_base = packet;
	iov.iov_len = IP_MAXPACKET;

	if (preload == 0)
		pinger();		/* send the first ping */

	(void)clock_gettime(CLOCK_MONOTONIC, &last);

	intvl.tv_sec = interval / 1000;
	intvl.tv_nsec = interval % 1000 * 1000000;

	almost_done = 0;
	while (!finish_up) {
		struct timespec now, timeout;
		fd_set rfds;
		int n;
		ssize_t cc;

		FD_ZERO(&rfds);
		FD_SET(srecv, &rfds);

		(void)clock_gettime(CLOCK_MONOTONIC, &now);
		timespecadd(&last, &intvl, &timeout);
		timespecsub(&timeout, &now, &timeout);
		if (timeout.tv_sec < 0)
			timespecclear(&timeout);
		
		n = pselect(srecv + 1, &rfds, NULL, NULL, &timeout, NULL);

		if (n == 1) {
			struct timespec *tv = NULL;

			msg.msg_namelen = sizeof(from);
			cc = recvmsg(srecv, &msg, 0);

			if (tv == NULL) {
				(void)clock_gettime(CLOCK_MONOTONIC, &now);
				tv = &now;
			}

			pr_pack((char *)packet, cc, &from, tv);
			
		}
	}
}

Totally, we now have 100 lines of code out of the more than 1,500 we started from!

As the capture filter, you can simply use icmp.

To fully understand CVE-2022-23093, let’s take a look back at the vulnerable code at the beginning of the pr_pack() function:

/*
 * Get size of IP header of the received packet. The
 * information is contained in the lower four bits of the
 * first byte.
 */
memcpy(&l, buf, sizeof(l));
hlen = (l & 0x0f) << 2;
memcpy(&ip, buf, hlen);

The vulnerability is due to hlen (the length of the IP header) being calculated based on the user input, so starting from the 4 lower bits of the first byte. Normally, the first byte of the IP header is always 0x45, corresponding to the character “E” in ASCII. This means:

• IP Version 4 (0x40)
• 0x5 being the length of the IP header in bytes, calculated as 0x5 << 2 = 5 * 2² = 20.