| शीर्षक | Tomato by Shibby Tomato Firmware Tomato v1.28 RT-N5x MIPSR2 build 124 Mini Stack out-of-bounds write |
|---|
| विवरण | setup_conntrack reads ct_tcp_timeout from NVRAM. If the NVRAM value is absent or does not parse as 10 unsigned integers, the function falls back to reading TCP conntrack timeout values from procfs and formats them into a fixed 72-byte stack buffer.
char buf[72];
v11 = read_conntrack_timeout("tcp", "established");
v12 = read_conntrack_timeout("tcp", "syn_sent");
v13 = read_conntrack_timeout("tcp", "syn_recv");
v14 = read_conntrack_timeout("tcp", "fin_wait");
v15 = read_conntrack_timeout("tcp", "time_wait");
v16 = read_conntrack_timeout("tcp", "close");
v17 = read_conntrack_timeout("tcp", "close_wait");
v18 = read_conntrack_timeout("tcp", "last_ack");
sprintf(buf, "0 %u %u %u %u %u %u %u %u 0",
v11, v12, v13, v14, v15, v16, v17, v18);
nvram_set("ct_tcp_timeout", buf);
In the worst case, the formatted output is approximately 92 bytes, exceeding the 72-byte destination buffer. |
|---|
| स्रोत | ⚠️ https://gitee.com/Fengyi-Wang/CVE/issues/IJTQ5S |
|---|
| उपयोगकर्ता | Cormac315 (UID 97273) |
|---|
| सबमिशन | 10/06/2026 04:18 PM (1 महीना पहले) |
|---|
| संयम | 17/07/2026 04:14 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 379799 [Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124 /sbin/rc setup_conntrack ct_tcp_timeout बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|