C signed-integer-based attacks

Question

I was reading this question and one of the comments mentioned C signed-integer-based attacks.

I know what is an int overflow is, but I don't understand how can this be used to attack a program.
what exactly is meant by attacking a program ? and if you know the program has this bug, how can you use it ?
Is this only limited to signed int.
If yes then why? and what is the case in C++ ?
my apologies if the question is trivial

The first use of a photographic image as malware carrier was, IIRC, a signed integer overflow attack on Internet Explorer, almost immediately after the source code was posted on the net. The code just assumed that the image headers were nice and correct. — Cheers and hth. - Alf, Jan 19 '14 at 14:28
All attacks exploit bugs in programs. Signed integer attacks exploit bugs where the developer made bad assumptions about the range of values their program would see. — brian beuning, Jan 19 '14 at 15:16

score 7 · Accepted Answer · answered Jan 19 '14 at 15:03

For example, there was a bug in the getpeername function from FreeBSD.

To illustrate it, let's take a function void copyFromKernel(char* dest, int size) that copies from a restricted memory area size bytes.

As you might already know, the memcpy function is declared like that:

void * memcpy ( void * destination, const void * source, size_t num );

Where size_t is an unsigned type. If in our function, we do something like:

void copy_from_kernel(void *user_dest, int maxlen) {
    int len = KSIZE < maxlen ? KSIZE : maxlen;
    memcpy(user_dest, kbuf, len);
}

, where KSIZE is the maximum number of bytes we want to allow for the user to copy. If the caller sends a positive value for maxlen, the function works as expected. But if the caller sends a negative value for maxlen, then the comparison would pass and memcpy's third parameter would be that negative value. As it is converted to unsigned, the number of bytes copied would be huge, thus the caller may get restricted data.

score 3 · Answer 2 · answered Jan 19 '14 at 14:32

3

A very simple case could be an overflow on id in the following example. Imagine that id is the id of a user. And you create a ton of fake users or I don't know to create an overflow. And 0 is the id of the administrator.

if (id > 0) {
   // you don't have many privileges
} else {
   // you are basically root and can do evil stuff.
}

answered Jan 19 '14 at 14:32

Maxime Chéramy

17,761
8
54
75

so it is not really limited to `signed int`, it is just that `singed int` are more likely to overflow, correct ? – Moha the almighty camel Jan 19 '14 at 14:52

score 1 · Answer 3 · answered Jan 19 '14 at 15:37

Most "anti-overflow" code is a combination of a range check followed by using the index to access memory. So if you can use int wrap-around to pass the range check (e.g. "if (index < max)" with index being negative) then you can access memory outside the intended target (e.g. "array[index] = value"). This coding mistake is less likely using unsigned.

score 0 · Answer 4 · answered Jan 19 '14 at 14:29

0

read about bit representations of signed and unsigned integers.

basically if the int is signed... and if it is accessible by the user (for example, it is loaded from user input)... if the user puts a bigger number then the integer can contain, the int will be in result negative...

if this int is the size of something in the program, it will turn out negative.

there is no such problem with unsigned ints

answered Jan 19 '14 at 14:29

blogresponder

43
3

5

You don't appear to answer the question. OP wrote: "I know what is an `int` overflow is, but I don't understand how can this be used to **attack** a program." – Jan 19 '14 at 14:31

score 0 · Answer 5 · answered Jan 19 '14 at 14:32

0

You can compare it with sql injection.
You supply the input with a very large no which the integer can't store and the program may show undefined behavior.
Whenever we store a bigger no that the capacity of int it wraps around and can turn out to be a negative no, which can be used by attacker. for eg:-

   int j ; 
   cin>>j ; 
   for(i=0;i<j;++i)
   {
        // Do some stuff 
   }

Now if the attacker enters a bigger no j becomes negative beacuse of wrapping around, and the for loop code is skipped by the program.

answered Jan 19 '14 at 14:32

Pratik Singhal

6,283
10
55
97

1

How exactly can it be compared to SWL injection? SQL injection causes attacker-supplied code to be run in a privileged environment. Integers, signed or not, are very rarely if ever run as code and even if they were, how are negative integers more dangerous in that scenario than positive ones? – Jan 19 '14 at 14:36

C signed-integer-based attacks

5 Answers5

Related