[Bug 298222] corrupt response packet can cause bsnmpwalk to write outside of array

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298222

            Bug ID: 298222
           Summary: corrupt response packet can cause bsnmpwalk to write
                    outside of array
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: bin
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu
 Attachment #274450 text/plain
         mime type:

Created attachment 274450
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=274450&action=edit
feed a negative error_index to snmpwalk

If the response packet to bsnmpwalk contains a negative error_index, it
is read into the signed int pdu->error_index by snmp_parse_pdus_hdr()
in contrib/bsnmp/lib/snmp.c:

                if (asn_get_integer(b, &pdu->error_index) != ASN_ERR_OK) {

Later snmp_output_err_resp() in
usr.sbin/bsnmpd/tools/libsnmptools/bsnmptools.c checks for too
large but not too small:

        if (pdu == NULL || (pdu->error_index > (int32_t) pdu->nbindings)) {
                fprintf(stdout, "Invalid error index in PDU\n");
                return;
        }

And can pass a bad pointer in the val argument to snmp_fill_object():

        if (!ISSET_NUMERIC(snmptoolctx) && (snmp_fill_object(snmptoolctx,
object,
            &(pdu->bindings[pdu->error_index - 1])) > 0))

asn_append_oid() fetches the length for memcpy() by dereferencing that
bad pointer, potentially causing a crash.

I've attached a demo that acts as a fake malicious snmp server, and
runs bsnmpwalk:

# uname -a
FreeBSD xxx 16.0-CURRENT FreeBSD 16.0-CURRENT #38
main-n275530-83854d0b37c2-dirty: Sat Aug 15 15:07:11 AST 2026    
root@xxx:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64
# cc snmpwalk1a.c
# ./a.out
SNMP: ignoring trailing junk in message
ASN.1: bad length for NULL (9) at 01 00 05 00 00 00 00 00 00 00 00
SNMP: ignoring junk at end of binding
SNMP: ignoring trailing junk after pdu
bsnmpwalk: Error 32 in response
Agent localhost:snmp returned error 
# ls -l *core*
-rw-------  1 root wheel 13295616 Sep  5 15:30 bsnmpwalk.core

#0  memcpy () at /usr/src/lib/libc/amd64/string/memmove.S:304
#1  0x000000080108369a in asn_append_oid (to=to@entry=0x801e14a10, 
    from=from@entry=0x7ffffffcac18) at /usr/src/contrib/bsnmp/lib/asn1.c:922
#2  0x000000000102fab6 in snmp_fill_object (
    snmptoolctx=snmptoolctx@entry=0x7fffffffe920, obj=obj@entry=0x801e14a00, 
    val=0x7ffffffcac18)
    at /usr/src/usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c:1859
#3  0x000000000102f945 in snmp_output_err_resp (snmptoolctx=0x7fffffffe920, 
    pdu=0x7ffffffcb450)
    at /usr/src/usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c:2009
#4  0x00000000010293db in snmptool_walk (snmptoolctx=0x7fffffffe920)
    at /usr/src/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c:490
#5  0x00000000010286d3 in main (argc=<optimized out>, argv=0x7fffffffe9f0)
    at /usr/src/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c:1288

-- 
You are receiving this mail because:
You are the assignee for the bug.