Unbounded strcpy into sockaddr_un.sun_path in bsd_create_listen_socket_unix / bsd_create_connect_socket_unix (stack buffer overflow)

[eskilmo]

• Vulnerability Type: Buffer Overflow / Unsafe String Copy
• Location:
  • external/uWebSockets/uSockets/bsd.c:570
  • external/uWebSockets/uSockets/bsd.c:755
• Code:
  • Line 570: strcpy(server_address.sun_path, path);
  • Line 755: strcpy(server_address.sun_path, server_path);
• Explanation:
  • The strcpy() function is used to copy a string into a fixed-size buffer (sun_path member of sockaddr_un structure, which is typically 108 bytes). If the input path or server_path exceeds this buffer size, it will overflow the stack, potentially allowing arbitrary code execution. This is a classic memory safety vulnerability.

[eskilmo]

Suggested fix (AI generated - review with care)

Reject paths that exceed sun_path size before copying:

if (strlen(path) >= sizeof(server_address.sun_path)) {
    return LIBUS_SOCKET_ERROR;
}
strcpy(server_address.sun_path, path);

Apply the same guard in both bsd_create_listen_socket_unix and bsd_create_connect_socket_unix.

If silent truncation is acceptable, strncpy with an explicit NUL terminator works too:

strncpy(server_address.sun_path, path, sizeof(server_address.sun_path) - 1);
server_address.sun_path[sizeof(server_address.sun_path) - 1] = '\0';

[uNetworkingAB]

You don't have anything better to do than write these highly sensationalist nonsense reports? If you want it fixed you can make a PR with those 4 lines of if case. Normal people do that.

arbitrary code execution

[eskilmo]

Hi, sorry for the lack of context, I should have explained this from the start. I'm a master's student doing security research on the srsRAN codebase (now OCUDU), and static analyser tools and LLM analysis flagged these functions in the vendored copy of uSockets as potentially dangerous. I was asked by the srsRAN/OCUDU developers to confirm whether this is a genuine issue in your codebase, or whether there is some context I have missed that rules out the possibility of it leading to a bug or exploit, as I have limited familiarity with uSockets myself (this is not the focus of my study). I apologies for the poor and overstated explanation.

I filed an issue rather than a PR to give you the option to fix it in your own style, and I did not find any other place of contact to file a report to explain this. Sorry again for the lack of context.

[uNetworkingAB]

asked by the srsRAN/OCUDU developers to confirm whether this is a genuine issue in your codebase

It's obviously a (minor) bug, but you can't "exploit" it because remote end users never control where the server listens. That's why, a normal person, would just file a basic small PR without comments and I would just click "merge" without comments.

[eskilmo]

Thanks for clarifying, I understand.