| tiêu đề | libimobiledevice fa0f79190142bc309307967c058f89c1b36eb6b8 - version 1.4.0 Memory corruption |
|---|
| Mô tả | unpaired key → strdup(NULL)
Location: src/afc.c:640-645
for (ptr = kvps; *ptr; ptr++) {
if (!strcmp(*ptr, key)) {
*value = strdup(*(ptr+1)); // no check that a value follows
break;
}
}
Root cause. Device info is a flat NUL-separated key/value list turned into a char** with a NULL sentinel. An odd list (lone key) leaves the matched key's ptr+1 pointing at the NULL sentinel → strdup(NULL) → strlen(NULL) → SIGSEGV.
Trigger (peer): reply to GET_DEVINFO with body ModelNumber\0 only; victim calls afc_get_device_info_key(client, "ModelNumber", &value).
Impact. Reliable NULL deref / crash (DoS). With prior Bug heap corruption, the sentinel can be attacker-influenced → arbitrary read into strdup |
|---|
| Nguồn | ⚠️ https://bohmid-com.vercel.app/#/article/blog-afc-writeup |
|---|
| Người dùng | ahmed0000 (UID 51651) |
|---|
| Đệ trình | 01/10/2026 17:21 (cách đây 26 ngày) |
|---|
| Kiểm duyệt | 25/10/2026 18:44 (24 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 426298 [libimobiledevice đến 1.4.0 Device Info src/afc.c afc_get_device_info_key value tràn bộ đệm] |
|---|
| điểm | 20 |
|---|