heap-based buffer overflow in hashcat

Executive Summary

This vulnerability is a heap-based buffer overflow in hashcat's outfile_write() function. When processing output with --username and --show flags, the function appends username, separator, hash, and plaintext to a fixed 16MB buffer without checking total length. Crafted oversized usernames can fill most of the buffer, causing subsequent appends to exceed capacity and corrupt memory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if hashcat is running with the --username and --show flags against a crafted hash file containing an oversized username. Monitor for crashes like SIGSEGV or ASAN heap-buffer-overflow errors during output formatting.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to crash hashcat (SIGSEGV) or potentially execute arbitrary code by corrupting memory. Users running affected versions with --username --show flags on malicious hash files are vulnerable. The crash could disrupt password cracking operations or lead to denial-of-service conditions.

Useful 0 Not Useful 0

Mitigation Strategies

Update hashcat to the latest patched version that includes bounded appenders in outfile_write to prevent buffer overflows. Avoid using --username and --show flags until patched. Monitor for crashes or memory corruption as indicators of exploitation.

Useful 0 Not Useful 0