Shibby Tomato Stack Out-of-Bounds Write Vulnerability in `setup_conntrack` Function

A stack out-of-bounds write vulnerability has been identified in Shibby Tomato version 1.28 RT-N5x MIPSR2 Build 124. The issue arises in the `setup_conntrack` function within the `sbin/rc` file, where the `ct_tcp_timeout` argument is manipulated. This flaw allows for an out-of-bounds write by improperly handling TCP timeout values, which can be exploited remotely.

Impact

Exploitation of this vulnerability overwrites adjacent stack memory, potentially corrupting saved registers and causing instability in the `rc` script during conntrack and firewall setup. This could lead to a local denial-of-service condition or corruption of service startup processes, unless a stronger exploitation chain is demonstrated.

Reproduction

The vulnerability can be reproduced by setting the `ct_tcp_timeout` value in NVRAM to an invalid state or omitting it entirely. The `setup_conntrack` function will then revert to using TCP conntrack timeout values from procfs. These values are read and formatted into a fixed 72-byte stack buffer using `sprintf`, without proper length validation. This oversight allows for approximately 20 bytes of overflow, corrupting the stack.