Bypassing MiniUPnP Stack Smashing Protection
Summary: Cisco Talos detailed a working exploit against the Bitcoin-qt wallet that abuses a buffer overflow in the client-side code of the MiniUPnP library, a flaw Talos reported in 2015 and that was fixed and assigned CVE 2015-6031. The exploit bypasses Stack Smashing Protection by overwriting the AT_SYSINFO auxiliary vector pointer to __kernel_vsyscall, then uses a ROP gadget to restore that pointer before calling mprotect() to make shellcode executable.
Key Takeaway: The overflow is reachable through the XML a UPnP Internet Gateway Device returns when a client fetches its description file, so a malicious or compromised device on the local network can trigger it in an application compiled with SSP - and the published exploit carries hardcoded addresses because it does not address ASLR.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026