28 lines
1.1 KiB
YAML
28 lines
1.1 KiB
YAML
cve: CVE-2014-0160
|
|
alias: Heartbleed
|
|
cwe_primary: CWE-125
|
|
cwe_acceptable: [CWE-125, CWE-119, CWE-126, CWE-200, CWE-787]
|
|
target_file: source.c
|
|
vuln_lines: [37, 38, 45, 46]
|
|
severity: high
|
|
vuln_class: out_of_bounds_read
|
|
exploit_pattern_regex: 'payload\s*[><]|memcpy.*pl.*payload|attacker.*controlled.*length'
|
|
must_mention_any:
|
|
- bounds check
|
|
- payload length
|
|
- attacker controlled
|
|
- memcpy
|
|
- out-of-bounds read
|
|
- information disclosure
|
|
points: 30
|
|
notes: |
|
|
Vulnerability: `payload` is read from the network (n2s on line 37) into a 16-bit
|
|
unsigned int. The implementation trusts that `payload` reflects the actual data
|
|
length in the heartbeat record and uses it on line 46 (memcpy) and as
|
|
allocation size (line 41). No comparison against `s->s3_rrec_length` is performed
|
|
before the memcpy, leaking up to 64 KiB of process memory.
|
|
Hunter MUST identify:
|
|
1. Missing bounds check between declared payload length and actual record length
|
|
2. memcpy from `pl` (network pointer) for `payload` bytes
|
|
3. The result is an out-of-bounds read disclosing memory.
|