Active Boosts

Boost _ Firedancer v0.1 34290 - [Blockchain_DLT - Medium] bank tile overflow

Submitted on Thu Aug 08 2024 11:40:14 GMT-0400 (Atlantic Standard Time) by @gln for Boost | Firedancer v0.1

Report ID: #34290

Report type: Blockchain/DLT

Report severity: Medium

Target: https://github.com/firedancer-io/firedancer/tree/e60d9a6206efaceac65a5a2c3a9e387a79d1d096

Impacts:

  • Process to process RCE between sandboxed tiles

Description

Brief/Intro

Bank tile incorrectly pre-allocates memory for storing incoming transactions.

As a result buffer overflow will occur when it tries to process microblock containing several txns.

Vulnerability Details

The bank tile calls fd_bank_abi_txn_init() function to process incoming transactions.

Let's look at the code of this function https://github.com/firedancer-io/firedancer/blob/main/src/disco/bank/fd_bank_abi.c#L270

Transaction is being processed and parsed data is written into 'out_sidecar' and 'out_txn' buffers.

Let's see how pointers to these buffer are handled inside bank tile:

Lines #1, #2 - on each loop iteration both pointers are being incremented.

Initially , both txn_abi_mem and txn_sidecar_mem bufferrs were allocated like this:

The issue is that on line #3 txn_sidecar_mem was allocated to store single transaction of max size (FD_BANK_ABI_TXN_FOOTPRINT_SIDECAR_MAX).

To simplify things we will focus on legacy txns.

The sizes of txn_abi_mem and txn_sidecar_mem buffers are 7688 and 18096 bytes.

The maximum number of txns in microblock is 31.

So, when fd_bank_abi_txn_init() will try to process several transactions and store them in these buffers, heap overflow will occur.

To trigger the issue I modified fuzz_txn_parse fuzzer, basically after parsing txn and making sure it is valid the fuzzer tries to store it in pre-allocated buffers.

The logic is exactly the same as in fd_bank_abi_txn_init() function.

Impact Details

Buffer overflow in bank tile during txn processing. Possibility of inter-tile RCE.

Proof of concept

Proof of Concept

How to reproduce:

  1. get archive by using provided gist link

  2. decode and unpack it

  1. copy provided fuzzer over fuzz_txn_parse.c fuzzer and build firedancer with 'make -j fuzz-test'

  2. run fuzz_txn_parse fuzzer with included test case:

PreviousBoost _ Firedancer v0.1 34272 - [Blockchain_DLT - Medium] Remote memory corruption in Shred tileNextBoost _ Firedancer v0.1 34501 - [Blockchain_DLT - Medium] DoS in shreds validation

Last updated

Was this helpful?