srsran/srsRAN_Project

srsGNB out-of-bound shift problem in pseudo_random_generator

lbm98 opened this issue · 0 comments

Issue Description

srsGNB does an out-of-bound shift within the random number generator at the two places:

uint8_t output_word = ((c >> (24u - (count * nof_bits_per_byte))) & mask) >> right_shift;

input_word ^ ((static_cast<uint8_t>((c >> (24u - (count * nof_bits_per_byte))) & 0xff)) >> right_shift);

Setup Details

Can be reproduced by compiling the test suite with UndefinedBehaviorSanitizer enabled
and executing the following testsuite.

cmake \
    -B build-ubsan \
    -G Ninja \
    -DCMAKE_CXX_COMPILER=clang++ \
    -DCMAKE_CXX_FLAGS="-fsanitize=undefined -fno-sanitize-recover=all"

Expected Behavior

The shift stays in-bound of the data type.

Actual Behaviour

UndefinedBehaviorSanitizer generates the following two errors

runtime error: shift exponent 4294967288 is too large for 32-bit type 'uint32_t' (aka 'unsigned int')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /srs/srsRAN_Project/lib/phy/upper/sequence_generators/pseudo_random_generator_impl.cpp:127:33
runtime error: shift exponent 4294967288 is too large for 32-bit type 'uint32_t' (aka 'unsigned int')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /srs/srsRAN_Project/lib/phy/upper/sequence_generators/pseudo_random_generator_impl.cpp:299:50

Steps to reproduce the problem

Covered in setup details.

Additional Information

Out-of-bound shifts are undefined behavior which can lead to a security vulnerability.