Add project for OpenWRT mdnsd CVE-2020-11750

openwrt-mdnsd-cve-2020-11750/Dockerfile

@@ -0,0 +1,22 @@
+FROM debian:buster-slim
+LABEL maintainer="[email protected]"
+
+RUN apt-get update --allow-releaseinfo-change && \
+        apt-get install --no-install-recommends -y build-essential \
+        ca-certificates clang gcc-multilib \
+        g++-multilib subversion libc6-dbg
+
+WORKDIR /src
+
+# Get and build the latest libFuzzer
+RUN svn co https://llvm.org/svn/llvm-project/compiler-rt/trunk/lib/fuzzer Fuzzer
+RUN cd /src/Fuzzer && ./build.sh
+
+COPY /src/* /src/
+
+# Compile the harness
+RUN    CC=clang \
+       CXX=clang++ \
+       LIBFUZZER_A_PATH="/src/Fuzzer/libFuzzer.a" \
+       CFLAGS="-fsanitize=address,undefined,fuzzer-no-link -g -O1" \
+       CXXFLAGS="-fsanitize=address,undefined,fuzzer-no-link -g -O1" make

openwrt-mdnsd-cve-2020-11750/README.md

@@ -0,0 +1,47 @@
+# OpenWRT mdns CVE-2020-11750
+
+Three out-of-bounds access issues were found in OpenWRT's mdns. They were reported to the OpenWRT security address on April 9 2020, and a fix ([1](https://git.openwrt.org/?p=project/mdnsd.git;a=commit;h=e74a3f9883199e9db7220d52b78e5fbdb4441ca3), [2](https://git.openwrt.org/?p=project/mdnsd.git;a=commit;h=cdac0460ba50dc45735f0be2e19a5a8efc3dafe1)) was released soon after.
+
+The code included in this project is an edited version of the original OpenWRT mdns code and `__dn_expand` from musl libc's DNS resolution code.
+
+## To build
+
+Assuming you just want to build the docker image, run:
+
+```bash
+docker build -t forallsecure/openwrt-mdnsd-cve-2020-11750 .
+```
+
+## Get from Dockerhub
+
+If you don't want to build locally, you can pull a pre-built image
+directly from dockerhub:
+
+```bash
+docker pull forallsecure/openwrt-mdnsd-cve-2020-11750
+```
+
+
+## Run under Mayhem
+
+Change to the `openwrt-mdnsd-cve-2020-11750` folder and run:
+
+```bash
+mayhem run mayhem/mdnsd
+```
+
+and watch Mayhem replicate the bugs! These bugs take seconds!
+
+## Run locally
+
+You can run this locally by running the libfuzzer harness or standalone harness
+with qemu-afl inside the docker container.
+
+## POC
+
+We have included a proof of concept output under the `poc`
+directory.
+
+> Note: Fuzzing has some degree of non-determinism, so when you run
+yourself you may not get exactly this file.  This is expected; your
+output should still trigger the Oniguruma regex bug.

openwrt-mdnsd-cve-2020-11750/mayhem/mdnsd/Mayhemfile

@@ -0,0 +1,8 @@
+version: '1.5'
+project: openwrt-mdnsd-cve-2020-11750
+target: mdnsd
+baseimage: forallsecure/openwrt-mdnsd-cve-2020-11750
+duration: 60
+cmds:
+-   cmd: /src/fuzzer
+    libfuzzer: true

openwrt-mdnsd-cve-2020-11750/src/Makefile

@@ -0,0 +1,6 @@
+all: fuzzer
+
+fuzzer.o : fuzzer.c
+	$(CC) $(CFLAGS) -c fuzzer.c -o fuzzer.o
+fuzzer : fuzzer.o
+	$(CXX) $(CXXFLAGS) fuzzer.o $(LIBFUZZER_A_PATH) -o fuzzer