This is an archived web site made available for research purposes. The web site is no longer maintained.

Challenge Information - CROMU_00061

Commonly known as: Virtual_Machine


Rounds Enabled

69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93

Details

Original Versions

Known Vulnerabilities

  • CWE-122 - Heap-based Buffer Overflow
  • CWE-787 - Out-of-bounds Write
  • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

None

Author Information

"Jason Williams" jdw@cromulence.com

DARPA performer group

Cromulence LLC (CROMU)

Description

This service is a simple implementation of a virtual system simulator. It includes a simple flat model Memory Management Unit (MMU), Central Processing Unit (CPU) and Direct Memory Access (DMA) controller. The CPU is simple 16-bit processor with 16 general purpose registers, registers 0-15, with 15 being permanently dedicated as the Program Counter (PC). DMA devices include two peripherals a read and write peripheral for sending data via transmit/receive.

Feature List

This service features 3 central components. A CPU, MMU, and DMA controller. In addition a simple CLF (Cromu Loader File) loader is implemented for loading the virtual subsystem. Upon initial connection to the service it expects a 4-byte 32-bit value indicating the file size of the incoming CLF file. The file is then loaded into memory by parsing the load sections in the file and loading them into the MMU controller. Simple page protections is supported including READ/WRITE/EXECUTE page protections. The DMA controller supports two peripheral devices a CReadDevice and CSendDevice, one for sending data out over STDOUT and for reading data over STDIN. The DMA controller is setup using two registers, one for specifying the address for the DMA access and the next register for the DMA length. Basic CPU arithmetic supported includes: Addition, Subtraction, Multiplication and Division. Also supported is GetRand and GetSeedMaterial instructions that read data from a random number generator and GetSeedMaterial that partially uses magic page data.

Vulnerability

There is 1 vulnerability in this service.

This vulnerability is a rather simple failure to properly check the bounds of a memory array access. In the case of DMA operations it is possible to setup multiple DMA operations simultaneously. Each clock cycle of the simulator allows 1-byte of a DMA transfer to occur until the transfer is completed. The simulator has an array of active DMA transfers that is sized at 5 entries. Using the DMAInit, DMARead or DMAWrite instruction it is possible to initiate more than 5 DMA transfers, causing, an overflow of the array and a write out of bounds operation. The next consecutive address in memory to be clobbered by this operation is an array of pointers for the DMA peripherals. Each DMA peripheral is an overriden class of the base class CPeripheral. Each derived peripheral class overrides the Read and Write operations of the peripherals. It is possible to overwrite the DMA peripheral array and replace the class pointer with a fake class object that results in a virtual function pointer call controlled by user input. Next a push, pop, pop, ret trampoline can be found for setting a desired register for expressing a type 1 POV.

Generic class of vulnerability

Vulnerability 1 of 1: Improper bounds check on a memory buffer. Heap based buffer overflow

CWE classification

Vulnerability 1 of 1: CWE-787: Out-of-bounds Write CWE-122: Heap-based Buffer Overflow

Challenges

Authors Subjective Challenge Difficulty: Discovering: Medium/Hard Proving: Easy Fixing: Medium

This CB has 1 vulnerability and can be difficult for a CRS to discover due to the large number of instructions and states of the input. It is however possible that a fuzzer using a proper polling input could duplicate a DMARead or DMAWrite call under the right circumstances and uncover the overflow.


POV Information

Round Source Destination Result POV Analysis Video
70 CSDS CodeJitsu Failed POV POV Watch
70 CSDS DeepRed Failed POV POV Watch
70 CSDS Disekt Failed POV POV Watch
70 CSDS ForAllSecure Failed POV POV Watch
70 CSDS Shellphish Failed POV POV Watch
70 CSDS TECHx Failed POV POV Watch
70 DeepRed CodeJitsu Failed POV POV Watch
70 DeepRed CSDS Failed POV POV Watch
70 DeepRed Disekt Failed POV POV Watch
70 DeepRed ForAllSecure Failed POV POV Watch
70 DeepRed Shellphish Failed POV POV Watch
70 DeepRed TECHx Failed POV POV Watch
71 CSDS CodeJitsu Failed POV POV Watch
71 CSDS DeepRed Failed POV POV Watch
71 CSDS Disekt Failed POV POV Watch
71 CSDS ForAllSecure Failed POV POV Watch
71 CSDS Shellphish Failed POV POV Watch
71 CSDS TECHx Failed POV POV Watch
71 DeepRed CodeJitsu Failed POV POV Watch
71 DeepRed CSDS Failed POV POV Watch
71 DeepRed Disekt Failed POV POV Watch
71 DeepRed ForAllSecure Failed POV POV Watch
71 DeepRed Shellphish Failed POV POV Watch
71 DeepRed TECHx Failed POV POV Watch
72 CSDS CodeJitsu Failed POV POV Watch
72 CSDS DeepRed Failed POV POV Watch
72 CSDS Disekt Failed POV POV Watch
72 CSDS ForAllSecure Failed POV POV Watch
72 CSDS Shellphish Failed POV POV Watch
72 CSDS TECHx Failed POV POV Watch
72 DeepRed CodeJitsu Failed POV POV Watch
72 DeepRed CSDS Failed POV POV Watch
72 DeepRed Disekt Failed POV POV Watch
72 DeepRed ForAllSecure Failed POV POV Watch
72 DeepRed Shellphish Failed POV POV Watch
72 DeepRed TECHx Failed POV POV Watch
73 CSDS CodeJitsu Failed POV POV Watch
73 CSDS DeepRed Failed POV POV Watch
73 CSDS Disekt Failed POV POV Watch
73 CSDS ForAllSecure Failed POV POV Watch
73 CSDS Shellphish Failed POV POV Watch
73 CSDS TECHx Failed POV POV Watch
73 DeepRed CodeJitsu Failed POV POV Watch
73 DeepRed CSDS Failed POV POV Watch
73 DeepRed Disekt Failed POV POV Watch
73 DeepRed ForAllSecure Failed POV POV Watch
73 DeepRed Shellphish Failed POV POV Watch
73 DeepRed TECHx Failed POV POV Watch
74 CodeJitsu Shellphish Failed POV through defenses POV Watch
74 CSDS CodeJitsu Failed POV POV Watch
74 CSDS DeepRed Failed POV POV Watch
74 CSDS Disekt Failed POV POV Watch
74 CSDS ForAllSecure Failed POV POV Watch
74 CSDS Shellphish Failed POV through defenses POV Watch
74 CSDS TECHx Failed POV POV Watch
74 DeepRed CodeJitsu Failed POV POV Watch
74 DeepRed CSDS Failed POV POV Watch
74 DeepRed Disekt Failed POV POV Watch
74 DeepRed ForAllSecure Failed POV POV Watch
74 DeepRed Shellphish Failed POV through defenses POV Watch
74 DeepRed TECHx Failed POV POV Watch
75 CodeJitsu Disekt Failed POV through defenses POV Watch
75 CSDS CodeJitsu Failed POV POV Watch
75 CSDS DeepRed Failed POV POV Watch
75 CSDS Disekt Failed POV through defenses POV Watch
75 CSDS ForAllSecure Failed POV POV Watch
75 CSDS Shellphish Failed POV through defenses POV Watch
75 CSDS TECHx Failed POV POV Watch
75 DeepRed CodeJitsu Failed POV POV Watch
75 DeepRed CSDS Failed POV POV Watch
75 DeepRed Disekt Failed POV through defenses POV Watch
75 DeepRed ForAllSecure Failed POV POV Watch
75 DeepRed Shellphish Failed POV through defenses POV Watch
75 DeepRed TECHx Failed POV POV Watch
76 CSDS CodeJitsu Failed POV POV Watch
76 CSDS DeepRed Failed POV POV Watch
76 CSDS Disekt Failed POV through defenses POV Watch
76 CSDS ForAllSecure Failed POV POV Watch
76 CSDS Shellphish Failed POV through defenses POV Watch
76 CSDS TECHx Failed POV POV Watch
76 DeepRed CodeJitsu Failed POV POV Watch
76 DeepRed CSDS Failed POV POV Watch
76 DeepRed Disekt Failed POV through defenses POV Watch
76 DeepRed ForAllSecure Failed POV POV Watch
76 DeepRed Shellphish Failed POV through defenses POV Watch
76 DeepRed TECHx Failed POV POV Watch
77 CSDS CodeJitsu Failed POV POV Watch
77 CSDS DeepRed Failed POV POV Watch
77 CSDS Disekt Failed POV through defenses POV Watch
77 CSDS ForAllSecure Failed POV POV Watch
77 CSDS Shellphish Failed POV through defenses POV Watch
77 CSDS TECHx Failed POV POV Watch
77 DeepRed CodeJitsu Failed POV POV Watch
77 DeepRed CSDS Failed POV POV Watch
77 DeepRed Disekt Failed POV through defenses POV Watch
77 DeepRed ForAllSecure Failed POV POV Watch
77 DeepRed Shellphish Failed POV through defenses POV Watch
77 DeepRed TECHx Failed POV POV Watch
78 CSDS CodeJitsu Failed POV POV Watch
78 CSDS DeepRed Failed POV POV Watch
78 CSDS Disekt Failed POV through defenses POV Watch
78 CSDS ForAllSecure Failed POV POV Watch
78 CSDS Shellphish Failed POV through defenses POV Watch
78 CSDS TECHx Failed POV POV Watch
78 DeepRed CodeJitsu Failed POV POV Watch
78 DeepRed CSDS Failed POV POV Watch
78 DeepRed Disekt Failed POV through defenses POV Watch
78 DeepRed ForAllSecure Failed POV POV Watch
78 DeepRed Shellphish Failed POV through defenses POV Watch
78 DeepRed TECHx Failed POV POV Watch
79 CSDS CodeJitsu Failed POV POV Watch
79 CSDS DeepRed Failed POV POV Watch
79 CSDS Disekt Failed POV through defenses POV Watch
79 CSDS ForAllSecure Failed POV POV Watch
79 CSDS Shellphish Failed POV through defenses POV Watch
79 CSDS TECHx Failed POV POV Watch
79 DeepRed CodeJitsu Failed POV POV Watch
79 DeepRed CSDS Failed POV POV Watch
79 DeepRed Disekt Failed POV through defenses POV Watch
79 DeepRed ForAllSecure Failed POV POV Watch
79 DeepRed Shellphish Failed POV through defenses POV Watch
79 DeepRed TECHx Failed POV POV Watch
80 CSDS CodeJitsu Failed POV POV Watch
80 CSDS DeepRed Failed POV POV Watch
80 CSDS Disekt Failed POV through defenses POV Watch
80 CSDS ForAllSecure Failed POV POV Watch
80 CSDS Shellphish Failed POV through defenses POV Watch
80 CSDS TECHx Failed POV POV Watch
80 DeepRed CodeJitsu Failed POV POV Watch
80 DeepRed CSDS Failed POV POV Watch
80 DeepRed Disekt Failed POV through defenses POV Watch
80 DeepRed ForAllSecure Failed POV POV Watch
80 DeepRed Shellphish Failed POV through defenses POV Watch
80 DeepRed TECHx Failed POV POV Watch
81 CSDS CodeJitsu Failed POV POV Watch
81 CSDS DeepRed Failed POV POV Watch
81 CSDS Disekt Failed POV through defenses POV Watch
81 CSDS ForAllSecure Failed POV POV Watch
81 CSDS Shellphish Failed POV through defenses POV Watch
81 CSDS TECHx Failed POV POV Watch
81 DeepRed CodeJitsu Failed POV POV Watch
81 DeepRed CSDS Failed POV POV Watch
81 DeepRed Disekt Failed POV through defenses POV Watch
81 DeepRed ForAllSecure Failed POV POV Watch
81 DeepRed Shellphish Failed POV through defenses POV Watch
81 DeepRed TECHx Failed POV POV Watch
82 CSDS CodeJitsu Failed POV POV Watch
82 CSDS DeepRed Failed POV POV Watch
82 CSDS Disekt Failed POV through defenses POV Watch
82 CSDS ForAllSecure Failed POV POV Watch
82 CSDS Shellphish Failed POV through defenses POV Watch
82 CSDS TECHx Failed POV POV Watch
82 DeepRed CodeJitsu Failed POV POV Watch
82 DeepRed CSDS Failed POV POV Watch
82 DeepRed Disekt Failed POV through defenses POV Watch
82 DeepRed ForAllSecure Failed POV POV Watch
82 DeepRed Shellphish Failed POV through defenses POV Watch
82 DeepRed TECHx Failed POV POV Watch
83 CSDS CodeJitsu Failed POV POV Watch
83 CSDS DeepRed Failed POV POV Watch
83 CSDS Disekt Failed POV through defenses POV Watch
83 CSDS ForAllSecure Failed POV POV Watch
83 CSDS Shellphish Failed POV through defenses POV Watch
83 CSDS TECHx Failed POV POV Watch
83 DeepRed CodeJitsu Failed POV POV Watch
83 DeepRed CSDS Failed POV POV Watch
83 DeepRed Disekt Failed POV through defenses POV Watch
83 DeepRed ForAllSecure Failed POV POV Watch
83 DeepRed Shellphish Failed POV through defenses POV Watch
83 DeepRed TECHx Failed POV POV Watch
84 CSDS CodeJitsu Failed POV POV Watch
84 CSDS DeepRed Failed POV POV Watch
84 CSDS Disekt Failed POV through defenses POV Watch
84 CSDS ForAllSecure Failed POV POV Watch
84 CSDS Shellphish Failed POV through defenses POV Watch
84 CSDS TECHx Failed POV POV Watch
84 DeepRed CodeJitsu Failed POV POV Watch
84 DeepRed CSDS Failed POV POV Watch
84 DeepRed Disekt Failed POV through defenses POV Watch
84 DeepRed ForAllSecure Failed POV POV Watch
84 DeepRed Shellphish Failed POV through defenses POV Watch
84 DeepRed TECHx Failed POV POV Watch
85 CSDS CodeJitsu Failed POV POV Watch
85 CSDS DeepRed Failed POV POV Watch
85 CSDS Disekt Failed POV through defenses POV Watch
85 CSDS ForAllSecure Failed POV POV Watch
85 CSDS Shellphish Failed POV through defenses POV Watch
85 CSDS TECHx Failed POV POV Watch
85 DeepRed CodeJitsu Failed POV POV Watch
85 DeepRed CSDS Failed POV POV Watch
85 DeepRed Disekt Failed POV through defenses POV Watch
85 DeepRed ForAllSecure Failed POV POV Watch
85 DeepRed Shellphish Failed POV through defenses POV Watch
85 DeepRed TECHx Failed POV POV Watch
86 CSDS CodeJitsu Failed POV POV Watch
86 CSDS DeepRed Failed POV POV Watch
86 CSDS Disekt Failed POV through defenses POV Watch
86 CSDS ForAllSecure Failed POV POV Watch
86 CSDS Shellphish Failed POV through defenses POV Watch
86 CSDS TECHx Failed POV POV Watch
86 DeepRed CodeJitsu Failed POV POV Watch
86 DeepRed CSDS Failed POV POV Watch
86 DeepRed Disekt Failed POV through defenses POV Watch
86 DeepRed ForAllSecure Failed POV POV Watch
86 DeepRed Shellphish Failed POV through defenses POV Watch
86 DeepRed TECHx Failed POV POV Watch
87 CSDS CodeJitsu Failed POV POV Watch
87 CSDS DeepRed Failed POV POV Watch
87 CSDS Disekt Failed POV through defenses POV Watch
87 CSDS ForAllSecure Failed POV POV Watch
87 CSDS Shellphish Failed POV through defenses POV Watch
87 CSDS TECHx Failed POV POV Watch
87 DeepRed CodeJitsu Failed POV POV Watch
87 DeepRed CSDS Failed POV POV Watch
87 DeepRed Disekt Failed POV through defenses POV Watch
87 DeepRed ForAllSecure Failed POV POV Watch
87 DeepRed Shellphish Failed POV through defenses POV Watch
87 DeepRed TECHx Failed POV POV Watch
88 CSDS CodeJitsu Failed POV POV Watch
88 CSDS DeepRed Failed POV POV Watch
88 CSDS Disekt Failed POV through defenses POV Watch
88 CSDS ForAllSecure Failed POV POV Watch
88 CSDS Shellphish Failed POV through defenses POV Watch
88 CSDS TECHx Failed POV POV Watch
88 DeepRed CodeJitsu Failed POV POV Watch
88 DeepRed CSDS Failed POV POV Watch
88 DeepRed Disekt Failed POV through defenses POV Watch
88 DeepRed ForAllSecure Failed POV POV Watch
88 DeepRed Shellphish Failed POV through defenses POV Watch
88 DeepRed TECHx Failed POV POV Watch
88 ForAllSecure CodeJitsu Failed POV POV Watch
88 ForAllSecure CSDS Failed POV POV Watch
88 ForAllSecure DeepRed Failed POV POV Watch
88 ForAllSecure Disekt Failed POV through defenses POV Watch
88 ForAllSecure Shellphish Failed POV through defenses POV Watch
88 ForAllSecure TECHx Failed POV POV Watch
89 CSDS CodeJitsu Failed POV POV Watch
89 CSDS DeepRed Failed POV POV Watch
89 CSDS Disekt Failed POV through defenses POV Watch
89 CSDS ForAllSecure Failed POV POV Watch
89 CSDS Shellphish Failed POV through defenses POV Watch
89 CSDS TECHx Failed POV POV Watch
89 DeepRed CodeJitsu Failed POV POV Watch
89 DeepRed CSDS Failed POV POV Watch
89 DeepRed Disekt Failed POV through defenses POV Watch
89 DeepRed ForAllSecure Failed POV POV Watch
89 DeepRed Shellphish Failed POV through defenses POV Watch
89 DeepRed TECHx Failed POV POV Watch
89 ForAllSecure CodeJitsu Failed POV POV Watch
89 ForAllSecure CSDS Failed POV POV Watch
89 ForAllSecure DeepRed Failed POV POV Watch
89 ForAllSecure Disekt Failed POV through defenses POV Watch
89 ForAllSecure Shellphish Failed POV through defenses POV Watch
89 ForAllSecure TECHx Failed POV POV Watch
90 CSDS CodeJitsu Failed POV POV Watch
90 CSDS DeepRed Failed POV POV Watch
90 CSDS Disekt Failed POV through defenses POV Watch
90 CSDS ForAllSecure Failed POV POV Watch
90 CSDS Shellphish Failed POV through defenses POV Watch
90 CSDS TECHx Failed POV POV Watch
90 DeepRed CodeJitsu Failed POV POV Watch
90 DeepRed CSDS Failed POV POV Watch
90 DeepRed Disekt Failed POV through defenses POV Watch
90 DeepRed ForAllSecure Failed POV POV Watch
90 DeepRed Shellphish Failed POV through defenses POV Watch
90 DeepRed TECHx Failed POV POV Watch
90 ForAllSecure CodeJitsu Failed POV POV Watch
90 ForAllSecure CSDS Failed POV POV Watch
90 ForAllSecure DeepRed Failed POV POV Watch
90 ForAllSecure Disekt Failed POV through defenses POV Watch
90 ForAllSecure Shellphish Failed POV through defenses POV Watch
90 ForAllSecure TECHx Failed POV POV Watch
91 CSDS CodeJitsu Failed POV POV Watch
91 CSDS DeepRed Failed POV POV Watch
91 CSDS Disekt Failed POV through defenses POV Watch
91 CSDS ForAllSecure Failed POV POV Watch
91 CSDS Shellphish Failed POV through defenses POV Watch
91 CSDS TECHx Failed POV POV Watch
91 DeepRed CodeJitsu Failed POV POV Watch
91 DeepRed CSDS Failed POV POV Watch
91 DeepRed Disekt Failed POV through defenses POV Watch
91 DeepRed ForAllSecure Failed POV POV Watch
91 DeepRed Shellphish Failed POV through defenses POV Watch
91 DeepRed TECHx Failed POV POV Watch
91 ForAllSecure CodeJitsu Failed POV POV Watch
91 ForAllSecure CSDS Failed POV POV Watch
91 ForAllSecure DeepRed Failed POV POV Watch
91 ForAllSecure Disekt Failed POV through defenses POV Watch
91 ForAllSecure Shellphish Failed POV through defenses POV Watch
91 ForAllSecure TECHx Failed POV POV Watch
92 CSDS CodeJitsu Failed POV POV Watch
92 CSDS DeepRed Failed POV POV Watch
92 CSDS Disekt Failed POV through defenses POV Watch
92 CSDS ForAllSecure Failed POV POV Watch
92 CSDS Shellphish Failed POV through defenses POV Watch
92 CSDS TECHx Failed POV POV Watch
92 DeepRed CodeJitsu Failed POV POV Watch
92 DeepRed CSDS Failed POV POV Watch
92 DeepRed Disekt Failed POV through defenses POV Watch
92 DeepRed ForAllSecure Failed POV POV Watch
92 DeepRed Shellphish Failed POV through defenses POV Watch
92 DeepRed TECHx Failed POV POV Watch
92 ForAllSecure CodeJitsu Failed POV POV Watch
92 ForAllSecure CSDS Failed POV POV Watch
92 ForAllSecure DeepRed Failed POV POV Watch
92 ForAllSecure Disekt Failed POV through defenses POV Watch
92 ForAllSecure Shellphish Failed POV through defenses POV Watch
92 ForAllSecure TECHx Failed POV POV Watch
93 CSDS CodeJitsu Failed POV POV Watch
93 CSDS DeepRed Failed POV POV Watch
93 CSDS Disekt Failed POV through defenses POV Watch
93 CSDS ForAllSecure Failed POV POV Watch
93 CSDS Shellphish Failed POV through defenses POV Watch
93 CSDS TECHx Failed POV POV Watch
93 DeepRed CodeJitsu Failed POV POV Watch
93 DeepRed CSDS Failed POV POV Watch
93 DeepRed Disekt Failed POV through defenses POV Watch
93 DeepRed ForAllSecure Failed POV POV Watch
93 DeepRed Shellphish Failed POV through defenses POV Watch
93 DeepRed TECHx Failed POV POV Watch
93 ForAllSecure CodeJitsu Failed POV POV Watch
93 ForAllSecure CSDS Failed POV POV Watch
93 ForAllSecure DeepRed Failed POV POV Watch
93 ForAllSecure Disekt Failed POV through defenses POV Watch
93 ForAllSecure Shellphish Failed POV through defenses POV Watch
93 ForAllSecure TECHx Failed POV POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email