CVE-2020-8448: analysisd: OS_CleanMSG segfault processing invalid msg location.

[cpu]

In src/analysisd/cleanevent.c the ossec-analysisd's OS_CleanMSG function handles the location portion of a message differently when the first character after a 2 digit ID is (, indicating it came from a remote agent via ossec-remoted.

When remote agent locations are processed OS_CleanMSG tries to null terminate the received location substring of the overall log message to store in lf->location by advancing past the -> in the string to the first : character:

ossec-hids/src/analysisd/cleanevent.c

Lines 45 to 59 in abb36d4

	/* Is this from an agent? */
	if ( *msg == '(' )
	{ /* look past '->' for the first ':' */
	pieces = strchr(strstr(msg, "->"), ':');
	if(!pieces)
	{
	merror(FORMAT_ERROR, ARGV0);
	return(-1);
	}
	}
	*pieces = '\0';
	pieces++;
	os_strdup(msg, lf->location);

Unfortunately the nesting of strstr as the first argument to strchr on L48 doesn't account for the possibility of a location string that starts with ( but doesn't contain a ->.

E.g. processing the msg 00:(: will result in the strstr returning NULL, meaning the strchr call will be strchr(NULL, ":") and a segfault will occur.

This code was introduced in 95cd0c9 on Nov 13, 2013. I believe it affects OSSEC 2.7+.

It seems that in all cases ossec-remoted will always write a well-formed location into the message it writes to the ossec UNIX domain socket queue because it uses SendMSG and populates the locmsg unconditionally:

ossec-hids/src/remoted/secure.c

Lines 187 to 190 in abb36d4

	/* Generate srcmsg */
	snprintf(srcmsg, OS_FLSIZE, "(%s) %s",
	keys.keyentries[agentid]->name,
	keys.keyentries[agentid]->ip->ip);

ossec-hids/src/shared/mq_op.c

Line 85 in abb36d4

snprintf(tmpstr, OS_MAXSTR, "%c:%s->%s", loc, locmsg, message);

I believe that means the only way this is triggerable is with direct write access to the socket, and probably makes the exploitability very low.

One possible fix (edit: implemented in #1823) is to separate the strstr and return an error when it returns NULL before performing the subsequent strchr with the result pointer.

[cpu]

This was assigned CVE-2020-8448