Heap Out-of-Bounds Read in Net::IP::LPM

Executive Summary

The vulnerability in Net::IP::LPM versions through 1.10 for Perl is a heap out-of-bounds read caused by an unbounded prefix length. Specifically, the function addPrefixToTrie() reads bits from a prefix buffer based on a prefix length without verifying if the prefix length is valid for the address size (IPv4 or IPv6). This can cause the function to read memory beyond the allocated buffer when the prefix length exceeds the address width (e.g., greater than 32 for IPv4 or 128 for IPv6).

The prefix length is stored as an unsigned char, which limits the out-of-bounds read to a short distance past the buffer, but it can still cause memory safety issues. This out-of-bounds read occurs during trie construction and can be detected by memory safety tools like AddressSanitizer or valgrind, potentially aborting the process.

A patch fixes this by adding boundary checks to ensure the prefix length is within valid ranges before processing, preventing the out-of-bounds read and integer overflow.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a heap out-of-bounds read, which may cause a program crash or process abort if detected by memory safety tools. While the out-of-bounds data is not exposed through the module's API, the memory safety violation can disrupt normal operation, potentially leading to denial of service.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for heap out-of-bounds reads during trie construction in the Net::IP::LPM module. It is detectable under memory error detection tools such as AddressSanitizer, valgrind, or a hardened allocator, which can abort the process when the out-of-bounds read occurs.

To detect this on your system, you can run the Perl application using Net::IP::LPM under valgrind or AddressSanitizer to catch invalid memory reads. For example, using valgrind:

• valgrind --tool=memcheck perl your_script.pl

Or if you have compiled Perl or the module with AddressSanitizer support, run:

• ASAN_OPTIONS=detect_odr_violation=0 perl your_script.pl

These commands help detect heap out-of-bounds reads caused by invalid prefix lengths passed to the module.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to apply the patch that adds boundary checks on the prefix length before it is processed by the vulnerable function. This patch validates that the prefix length is within the valid range (0–32 for IPv4, 0–128 for IPv6) and matches the address length, preventing heap out-of-bounds reads and integer overflow.

If patching is not immediately possible, avoid passing prefix lengths greater than the valid maximums (32 for IPv4, 128 for IPv6) to the Net::IP::LPM module's add() function.

Additionally, running the application under memory error detection tools can help detect exploitation attempts and abort the process before damage occurs.

Useful 0 Not Useful 0