[Home]

Summary:ASTERISK-27658: WebSocket frames with 0 sized payload causes DoS
Reporter:Sean Bright (seanbright)Labels:security
Date Opened:2018-02-05 16:28:54.000-0600Date Closed:2018-02-21 12:15:07.000-0600
Priority:BlockerRegression?
Status:Closed/CompleteComponents:Resources/res_http_websocket
Versions:15.2.0 Frequency of
Occurrence
Related
Issues:
Environment:Attachments:( 0) AST-2018-006.pdf
Description:In ast_websocket_read() we don't adequately check that payload_len is > 0 before calling ws_safe_read(). Calling ws_safe_read with a len argument of 0 will result in a busy loop until the underlying socket is closed.
Comments:By: Asterisk Team (asteriskteam) 2018-02-05 16:28:55.783-0600

This issue has been automatically restricted and set to a blocker due to being a security type issue. If this is not a security vulnerability issue it will be moved to the appropriate issue type when triaged.

By: Asterisk Team (asteriskteam) 2018-02-05 16:28:56.343-0600

Thanks for creating a report! The issue has entered the triage process. That means the issue will wait in this status until a Bug Marshal has an opportunity to review the issue. Once the issue has been reviewed you will receive comments regarding the next steps towards resolution.

A good first step is for you to review the [Asterisk Issue Guidelines|https://wiki.asterisk.org/wiki/display/AST/Asterisk+Issue+Guidelines] if you haven't already. The guidelines detail what is expected from an Asterisk issue report.

Then, if you are submitting a patch, please review the [Patch Contribution Process|https://wiki.asterisk.org/wiki/display/AST/Patch+Contribution+Process].

By: Sean Bright (seanbright) 2018-02-05 16:31:23.303-0600

I originally said that 13 was affected but I have not tested, so I removed that version label. It is quite probable that the issue exists there as well.

By: Joshua C. Colp (jcolp) 2018-02-05 16:33:47.299-0600

I really should fix that logic... I think I'll do that know.

Regarding the issue I think this may be an iostream problem, so it would be limited to 15.

By: Benjamin Keith Ford (bford) 2018-02-14 20:19:01.619-0600

[~seanbright], do you know if this is isolated to 15, or does it affect other versions as well?

By: Sean Bright (seanbright) 2018-02-15 09:20:48.132-0600

[~bford], when iostreams were introduced, the logic in {{ws_safe_read}} was changed (specifically the if statement directly after the read), which exposes the problem. The only release version of Asterisk that contains iostreams is 15, so only 15 is currently affected.

In 13, we _could_ wrap the affected call to {{ws_safe_read}} with the payload length check just for cleanliness, but the bug is not present there.

By: Benjamin Keith Ford (bford) 2018-02-15 09:25:33.341-0600

Thanks for clarifying [~seanbright]!

By: Benjamin Keith Ford (bford) 2018-02-15 14:02:24.985-0600

Added advisory for review.

By: Sean Bright (seanbright) 2018-02-16 11:57:26.192-0600

Advisory looks fine to me

By: Friendly Automation (friendly-automation) 2018-02-21 12:15:08.235-0600

Change 8362 merged by Kevin Harwell:
AST-2018-006: Properly handle WebSocket frames with 0 length payload.

[https://gerrit.asterisk.org/8362|https://gerrit.asterisk.org/8362]

By: Friendly Automation (friendly-automation) 2018-02-21 12:15:18.313-0600

Change 8363 merged by Kevin Harwell:
AST-2018-006: Properly handle WebSocket frames with 0 length payload.

[https://gerrit.asterisk.org/8363|https://gerrit.asterisk.org/8363]

By: Friendly Automation (friendly-automation) 2018-02-21 14:13:16.751-0600

Change 8361 merged by Kevin Harwell:
AST-2018-006: Properly handle WebSocket frames with 0 length payload.

[https://gerrit.asterisk.org/8361|https://gerrit.asterisk.org/8361]