Exploit code for a critical vulnerability affecting networking devices using Realtek RTL819x system on a chip released online.
TheĀ PoC exploit codeĀ for a critical stack-based buffer overflow issue, tracked asĀ
āOn Realtek eCos SDK-based routers, the āSIP ALGā module is vulnerable to buffer overflow. The root cause of the vulnerability is insufficient validation on the received buffer, and unsafe calls to strcpy. The āSIP ALGā module calls strcpy to copy some contents of SIP packets to a predefined fixed buffer and does not check the length of the copied contents.ā reads theĀ advisoryĀ published by Realtek, which published the issue in March 2022. āA remote attacker can exploit the vulnerability through a WAN interface by crafting arguments in SDP data or the SIP header to make a specific SIP packet, and the successful exploitation would cause a crash or achieve the remote code execution.ā
Millions of devices, including routers and access points, are exposed to hacking.
The experts (Octavio Gianatiempo,Ā Octavio Galland,Ā Emilio Couto,Ā Javier Aguinaga)Ā disclosedĀ technical details of the flaw at the DEFCON hacker conference last week.
A remote attacker can exploit the flaw to execute arbitrary code without authentication by sending to the vulnerable devices specially crafted SIP packets with malicious SDP data.
The issue is very dangerous because the exploitation doesnāt require user interaction.
The PoC code developed by the experts works against Nexxt Nebula 300 Plus routers.
āThis repository contains the materials for the talk āExploring the hidden attack surface of OEM IoT devices: pwning thousands of routers with a vulnerability in Realtekās SDK for eCos OS.ā, which was presented atĀ DEFCON30.ā reads theĀ descriptionĀ provided with the exploit code on GitHub.
The repo includes:
- analysis: Automated firmware analysis to detect the presence of CVE-2022-27255 (Run
analyse_firmware.py). - exploits_nexxt: PoC and exploit code. The PoC should work on every affected router, however the exploit code is specific for the Nexxt Nebula 300 Plus router.
- ghidra_scripts: Vulnerable function call searching script and CVE-2022-27255 detection script.
- DEFCON: Slide deck & poc video.
Johannes Ullrich, Dean of Research at SANS shared a Snort rule that can be used to detect PoC exploit attempt.
āThe rule looks for āINVITEā messages that contain the string ām=audioĀ ā. It triggers if there are more than 128 bytes following the string (128 bytes is the size of the buffer allocated by the Realtek SDK) and if none of those bytes is a carriage return. The rule may even work sufficiently well without the last content match. Let me know if you see any errors or improvements.āĀ wroteĀ the expert.
Slides for the DEFCON presentation along with exploits, and a detection script forĀ
