Skip to content

Latest commit

 

History

History
136 lines (103 loc) · 9.55 KB

attack-tree.md

File metadata and controls

136 lines (103 loc) · 9.55 KB

Attack Tree Analysis for nothings/stb

Objective: Compromise Application via stb_image.h or stb_truetype.h

Attack Tree Visualization

Sub-tree (stb_image.h):

Goal: Compromise Application via stb_image.h
├── 1. Remote Code Execution (RCE) [HIGH RISK]
│   ├── 1.1 Buffer Overflow [CRITICAL]
│   │   ├── 1.1.1 Heap Overflow (during image decoding) [HIGH RISK]
│   │   │   ├── 1.1.1.1 Crafted image with excessively large dimensions. [CRITICAL]
│   │   │   └── 1.1.1.2 Crafted image with invalid compressed data (e.g., zlib, PNG chunks). [CRITICAL]
│   │   └── 1.1.3 Integer Overflow leading to Buffer Overflow [HIGH RISK]
│   │       └── 1.1.3.1 Crafted image with dimensions that cause integer overflows. [CRITICAL]
│   └── 1.3  Out-of-bounds Write [HIGH RISK]
│       └── 1.3.1 Crafted image with corrupted data that causes writes outside allocated memory. [CRITICAL]
├── 2. Denial of Service (DoS)
│   ├── 2.1 Excessive Memory Allocation [CRITICAL]
│   │   └── 2.1.1  Crafted image with extremely large dimensions.
│   └── 2.3 Resource Exhaustion [CRITICAL]
│       └── 2.3.1  Repeatedly sending large or complex images.

Sub-tree (stb_truetype.h):

Goal: Compromise Application via stb_truetype.h
├── 1. Remote Code Execution (RCE) [HIGH RISK]
│   ├── 1.1 Buffer Overflow [CRITICAL]
│   │   ├── 1.1.1 Heap Overflow (during font parsing or rendering) [HIGH RISK]
│   │   │   ├── 1.1.1.1 Crafted font with excessively large glyph data. [CRITICAL]
│   │   │   └── 1.1.1.2 Crafted font with invalid table entries (e.g., 'glyf', 'loca', 'head'). [CRITICAL]
│   │   └── 1.1.3 Integer Overflow leading to Buffer Overflow [HIGH RISK]
│   │       └── 1.1.3.1 Crafted font with table sizes or offsets that cause integer overflows. [CRITICAL]
│   └── 1.3 Out-of-bounds Write [HIGH RISK]
│       └── 1.3.1 Crafted font with corrupted data causing writes outside allocated memory. [CRITICAL]
├── 2. Denial of Service (DoS)
│   ├── 2.1 Excessive Memory Allocation [CRITICAL]
│   │   └── 2.1.1 Crafted font with extremely large glyphs or a large number of glyphs.
│   └── 2.3 Resource Exhaustion [CRITICAL]
│       └── 2.3.1 Repeatedly sending large or complex fonts.

Attack Tree Path: stb_image.h

  • 1. Remote Code Execution (RCE) [HIGH RISK]

    • The most severe outcome, allowing the attacker to execute arbitrary code.

    • 1.1 Buffer Overflow [CRITICAL]

      • A fundamental vulnerability where data written to a buffer exceeds its allocated size, overwriting adjacent memory.

      • 1.1.1 Heap Overflow (during image decoding) [HIGH RISK]

        • Occurs on the heap (dynamically allocated memory).

        • 1.1.1.1 Crafted image with excessively large dimensions. [CRITICAL]

          • Attacker provides an image with dimensions (width * height * channels) that, when multiplied, result in a memory allocation request larger than available or intended, potentially leading to a buffer overflow when the (smaller) allocated buffer is written to.
          • Example: An image claiming to be 100,000 x 100,000 pixels with 4 channels (RGBA) would require a massive amount of memory.

        • 1.1.1.2 Crafted image with invalid compressed data (e.g., zlib, PNG chunks). [CRITICAL]

          • Attacker provides an image with deliberately corrupted compressed data. When stb_image attempts to decompress this data, it might write more data than expected to the output buffer, causing a heap overflow. This exploits vulnerabilities in the decompression algorithms.
          • Example: A PNG image with a malformed IDAT chunk that, when decompressed, produces more data than indicated in the chunk header.

      • 1.1.3 Integer Overflow leading to Buffer Overflow [HIGH RISK]

        • An integer overflow occurs when an arithmetic operation results in a value that is too large to be represented by the data type.

        • 1.1.3.1 Crafted image with dimensions that cause integer overflows. [CRITICAL]

          • Attacker provides image dimensions that, when used in calculations (e.g., width * height * channels), cause an integer overflow. This results in a smaller-than-expected memory allocation, leading to a buffer overflow when the image data is decoded.
          • Example: If width, height, and channels are large int values, their product might wrap around to a small positive number due to integer overflow.

    • 1.3 Out-of-bounds Write [HIGH RISK]

      • Writing data outside the boundaries of an allocated memory region.

      • 1.3.1 Crafted image with corrupted data that causes writes outside allocated memory. [CRITICAL]

        • Attacker provides an image with corrupted data that, due to errors in the parsing logic, causes stb_image to write data before the start or after the end of the allocated image buffer. This can overwrite critical data structures or code pointers.
        • Example: A malformed JPEG image where the Huffman table decoding logic is tricked into writing data outside the intended buffer.

  • 2. Denial of Service (DoS)

    • 2.1 Excessive Memory Allocation [CRITICAL]

      • Forcing the application to allocate an unreasonable amount of memory.
      • 2.1.1 Crafted image with extremely large dimensions.
        • Similar to 1.1.1.1, but the goal is to exhaust memory, not necessarily to achieve RCE.

    • 2.3 Resource Exhaustion [CRITICAL]

      • Depleting system resources (CPU, memory, network bandwidth).
      • 2.3.1 Repeatedly sending large or complex images.
        • A simple but effective attack where the attacker repeatedly sends requests to the application, each containing a large or computationally expensive image.

Attack Tree Path: stb_truetype.h

  • 1. Remote Code Execution (RCE) [HIGH RISK]

    • The most severe outcome, allowing the attacker to execute arbitrary code.

    • 1.1 Buffer Overflow [CRITICAL]

      • A fundamental vulnerability where data written to a buffer exceeds its allocated size.

      • 1.1.1 Heap Overflow (during font parsing or rendering) [HIGH RISK]

        • Occurs on the heap.

        • 1.1.1.1 Crafted font with excessively large glyph data. [CRITICAL]

          • Attacker provides a font file where the data describing a glyph (its shape) is excessively large, leading to a large memory allocation. If the allocation is larger than expected or if there are errors in handling this large data, a buffer overflow can occur.
          • Example: A TrueType font with a 'glyf' table entry containing a glyph with an extremely complex outline, requiring a huge amount of memory to store.

        • 1.1.1.2 Crafted font with invalid table entries (e.g., 'glyf', 'loca', 'head'). [CRITICAL]

          • TrueType fonts are structured into tables (e.g., 'glyf' for glyph data, 'loca' for glyph locations, 'head' for header information). The attacker provides a font with deliberately corrupted or invalid table entries. This can cause stb_truetype to miscalculate buffer sizes or access memory incorrectly, leading to a buffer overflow.
          • Example: A font with a 'loca' table that contains incorrect offsets, causing stb_truetype to read or write data outside the bounds of the 'glyf' table.

      • 1.1.3 Integer Overflow leading to Buffer Overflow [HIGH RISK]

        • An integer overflow occurs when an arithmetic operation results in a value too large to be represented.

        • 1.1.3.1 Crafted font with table sizes or offsets that cause integer overflows. [CRITICAL]

          • Attacker provides a font where the sizes or offsets of tables within the font file are manipulated to cause integer overflows during calculations. This leads to incorrect memory allocation and subsequent buffer overflows.
          • Example: A font with a 'maxp' table (maximum profile) that specifies a very large number of glyphs, which, when multiplied by other values, causes an integer overflow.

    • 1.3 Out-of-bounds Write [HIGH RISK]

      • Writing data outside the boundaries of an allocated memory region.

      • 1.3.1 Crafted font with corrupted data causing writes outside allocated memory. [CRITICAL]

        • Attacker provides a font with corrupted data that, due to errors in the parsing logic (especially within specific table parsers like 'cmap' or 'hmtx'), causes stb_truetype to write data outside the allocated buffer.
        • Example: A malformed 'cmap' table (character map) that causes incorrect indexing into the glyph data, leading to an out-of-bounds write.

  • 2. Denial of Service (DoS)

    • 2.1 Excessive Memory Allocation [CRITICAL]

      • Forcing the application to allocate an unreasonable amount of memory.
      • 2.1.1 Crafted font with extremely large glyphs or a large number of glyphs.
        • Similar to 1.1.1.1, but the goal is to exhaust memory.

    • 2.3 Resource Exhaustion [CRITICAL]

      • Depleting system resources.
      • 2.3.1 Repeatedly sending large or complex fonts.
        • Repeatedly sending requests with large or computationally expensive fonts.