地图 / OOB read in TS_OBJ_print_bio() (CVE-2016-2180)

OOB read in TS_OBJ_print_bio() (CVE-2016-2180)

内存破坏 / 越界读 / #221789

厂商: Internet Bug Bounty
严重程度: 低危
赏金: —
弱点: 越界读
研究员: @theyarestone
披露日期: 2017-05-25
资产: OpenSSL (Legacy)
CVE: CVE-2016-2180

该报告还没有中文解读。

原文摘录

摘自原文（283 字符中的一小部分）

The function TS_OBJ_print_bio() misuses OBJ_obj2txt(): the return value is the total length the OID text representation would use and not the amount of data written. This will result in OOB reads when large OIDs are presented.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。

时间线

2017-04-18报告提交
2017-05-25公开披露

阅读 HackerOne 原文 ↗作者 @theyarestone · 版权归作者与 Internet Bug Bounty 所有

同类报告

OOB reads in network message handlers leads to RCEValve · 2021-05-04 · $7,500 RCE on CS:GO client using unsanitized entity ID in EntityMsg messageValve · 2021-05-27 · $9,000 CS:GO Server -> Client RCE through OOB access in CSVCMsg_SplitScreen + Info leak in HTTP downloadValve · 2021-05-17 · $7,500 Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijackingMariaDB · 2026-09-08 Firecracker Out-of-bounds Read/Write Local Privilege Escalation VulnerabilityAWS VDP · 2026-06-11 Conflux-queued zero-length RELAY_END triggers heap out-of-bounds readTor · 2026-09-10