An attacker can send NodeInfo with a empty publicKey first, then overwrite with a new key.
|
if (p.public_key.size > 0) { |
|
printBytes("Incoming Pubkey: ", p.public_key.bytes, 32); |
|
if (info->user.public_key.size > 0) { // if we have a key for this user already, don't overwrite with a new one |
|
LOG_INFO("Public Key set for node, not updating!"); |
|
// we copy the key into the incoming packet, to prevent overwrite |
|
memcpy(p.public_key.bytes, info->user.public_key.bytes, 32); |
|
} else { |
|
LOG_INFO("Update Node Pubkey!"); |
|
} |
|
} |
First sending a empty key bypasses if (p.public_key.size > 0) {, clearing the existing publicKey (and resetting the size to 0) for a known node.
Then a new key bypasses if (info->user.public_key.size > 0) {, and this mallicious key is stored in NodeDB.
|
auto lite = TypeConversions::ConvertToUserLite(p); |
|
memcpy(lite.public_key.bytes, user.public_key.bytes, sizeof(lite.public_key.bytes)); |
|
lite.public_key.size = user.public_key.size; |
I tested my commit with a few nodes and this seems to succesfully prevent the exploit.
Report above as shared by @dfsx1 in #6372. I've added it here so that the Security Advisories tab reflects this issue and the version of the firmware that were patched. Also, by getting a CVE, there is a way to keep track and reference this specific vulnerability.
dfsx1 Reporter
An attacker can send NodeInfo with a empty publicKey first, then overwrite with a new key.
firmware/src/mesh/NodeDB.cpp
Lines 1438 to 1447 in 1e4a013
First sending a empty key bypasses
if (p.public_key.size > 0) {, clearing the existing publicKey (and resetting the size to 0) for a known node.Then a new key bypasses
if (info->user.public_key.size > 0) {, and this mallicious key is stored in NodeDB.firmware/src/mesh/NodeDB.cpp
Line 1451 in 1e4a013
firmware/src/mesh/TypeConversions.cpp
Lines 87 to 88 in 1e4a013
I tested my commit with a few nodes and this seems to succesfully prevent the exploit.
Report above as shared by @dfsx1 in #6372. I've added it here so that the Security Advisories tab reflects this issue and the version of the firmware that were patched. Also, by getting a CVE, there is a way to keep track and reference this specific vulnerability.