[Full-disclosure] Bug in vde_plug, remote exploitation possible?
me at halfdog.net
Thu Sep 2 20:52:10 BST 2010
-----BEGIN PGP SIGNED MESSAGE-----
Vde (virtual distributed ethernet) is an ethernet compliant virtual network that
can be spawned over a set of physical computers over the internet ... (see
The vde_plug (at least on ubuntu hardy) contains a bug, that is triggered when a
certain amount of encapsulated ether frame data is sent to the plug in a
specially timed manner. When the input buffer is filled just with a single byte,
vde_plug uses also the first byte after the end of data, thus constructing an
invalid frame length. Depending on frame length, just one byte or the complete
buffer content is discarded, thus leading to lost single
byte or complete frame content.
See http://www.halfdog.net/Security/VdeNetBufferBug/ for more information.
It is very simple to trigger the bug by sending data directly to the vde_plug,
but I am searching for a way to trigger the bug using only data in transit. Has
someone an idea why the test program fails to trigger the bug?
Does someone know, in which software products the vde_plug component might be
PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
-----END PGP SIGNATURE-----
Full-Disclosure is hosted and sponsored by Secunia.