Summary

A stack-based buffer overflow vulnerability was discovered in the nDPI
(network Deep Packet Inspection) library's custom category matching function
ndpi_get_custom_category_match, which is called during ntopng's packet
dissection and host initialization path.

Root Cause

The function ndpi_get_custom_category_match in src/lib/ndpi_main.c
(line 5129) performs a 4-byte WRITE to a stack buffer that overflows a
2-byte variable id declared in IpAddress::reloadBlacklist at
src/IpAddress.cpp:88.

The stack frame layout shows:

• [32, 96) 'ipbuf' — 64-byte buffer
• [128, 130) 'id' — 2-byte variable (uint16_t)
• [144, 148) 'breed' — 4-byte variable

The function writes 4 bytes to offset 128, but id is only 2 bytes wide.
This partially overflows id and corrupts the stack mid-redzone (f2 bytes),
potentially reaching adjacent stack variables.

Trigger Condition

The vulnerability is triggered when ntopng processes network packets that
match custom category detection rules during protocol classification. This
occurs in the normal packet dissection path:

dissectPacket → processPacket → getFlow → findFlowHosts →
RemoteHost::RemoteHost → Host::initialize → IpAddress::reloadBlacklist →
ndpi_get_custom_category_match (OVERFLOW)

An attacker on the same network segment can send crafted packets that
trigger this code path. No authentication or user interaction is required.

Proof of Concept

Environment

• OS: Linux x86_64
• ntopng: latest master with nDPI (ASan-enabled build)
• Harness: fuzz_dissect_packet

Crash Output (AddressSanitizer)

==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ff93153a980 at pc 0x55d2fb794c3e
WRITE of size 4 at 0x7ff93153a980 thread T0
    #0 0x55d2fb794c3d in ndpi_get_custom_category_match /work/nDPI/src/lib/ndpi_main.c:5129:13
    #1 0x55d2fb2aab6c in IpAddress::reloadBlacklist(ndpi_detection_module_struct*) /work/ntopng/src/IpAddress.cpp:91:7
    #2 0x55d2fb21d339 in Host::initialize(Mac*, int, unsigned short, unsigned short) /work/ntopng/src/Host.cpp:387:3
    #3 0x55d2fb21ecda in Host::Host(...) /work/ntopng/src/Host.cpp:60:3
    #4 0x55d2fb5baeba in RemoteHost::RemoteHost(...) /work/ntopng/src/RemoteHost.cpp:29:7
    #5 0x55d2fb3df917 in NetworkInterface::findFlowHosts(...) /work/ntopng/src/NetworkInterface.cpp:4464:35
    ...

Address 0x7ff93153a980 is located in stack of thread T0 at offset 128 in frame
    #0 0x55d2fb2aa96f in IpAddress::reloadBlacklist /work/ntopng/src/IpAddress.cpp:85

  This frame has 3 object(s):
    [32, 96) 'ipbuf' (line 86)
    [128, 130) 'id' (line 88) <== Memory access at offset 128 partially overflows this variable
    [144, 148) 'breed' (line 89)

SUMMARY: AddressSanitizer: stack-buffer-overflow /work/nDPI/src/lib/ndpi_main.c:5129:13 in ndpi_get_custom_category_match

Impact Analysis

• 4-byte stack write in the protocol detection path, overflowing a 2-byte
  variable into the stack redzone.
• Triggerable remotely by sending crafted network packets on any network
  where ntopng performs traffic analysis.
• No authentication required. No user interaction needed.
• Stack corruption can be leveraged to overwrite return addresses or function
  pointers for code execution.
• ntopng is deployed on network monitoring appliances, IDS/IPS systems, and
  enterprise network infrastructure.
• Attack complexity: low — only requires network access to the monitored
  segment.

Field: Impact

Denial of service via crafted network packets. No authentication or user
interaction required. Affects ntopng deployments performing network traffic
analysis. The vulnerability is in the core packet dissection path. A type
mismatch (4-byte write to 2-byte variable) causes stack corruption detected
by AddressSanitizer. Network-triggered from any packet on the monitored
interface.

PoC files (for reproduction)

poc.bin — crafted network packet triggering custom category overflow

Docker reproduction steps

# Build
docker build --platform linux/amd64 \
  -f docker/ntopng-latest-asan.Dockerfile \
  -t ntopng-asan .

# Reproduce
docker run --rm --platform linux/amd64 \
  -v $(pwd)/poc.bin:/poc.bin \
  ntopng-asan /poc.bin

# Expected: ASan stack-buffer-overflow WRITE, exit 1

PoC & Reproduction Materials

Full reproduction package (PoC binaries, crash logs, Dockerfile, replay harness):

https://anonymous.4open.science/r/ntopng-reproduction-6F51/

Suggested fix

1. Fix the type mismatch in ndpi_get_custom_category_match: the function
   writes a 4-byte value (likely uint32_t) to a 2-byte variable (id is
   uint16_t). Either widen the id variable or truncate the write to match
   the declared type size.

2. In IpAddress::reloadBlacklist (IpAddress.cpp:88), change the id
   declaration to match the expected write size:

   // Before (vulnerable):
   uint16_t id;
   // After (fixed):
   uint32_t id;  // or ndpi_protocol_category_t

3. Add bounds validation in ndpi_get_custom_category_match before writing
   to the output parameter.

4. Add stack canary protection to the packet dissection path as defense
   in depth.