From c65b24cdfd9edbc25796ba7db9a9ca68513324e9 Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Wed, 4 Oct 2017 12:34:29 +0200 Subject: dnsmasq: CVE-2017-14496 Invalid boundary checks here. Integer underflow leading to a huge memcpy. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-14496 https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html Signed-off-by: Sona Sarmadi Signed-off-by: Adrian Dudau --- .../dnsmasq/dnsmasq/CVE-2017-14496.patch | 94 ++++++++++++++++++++++ recipes-networking/dnsmasq/dnsmasq_%.bbappend | 1 + 2 files changed, 95 insertions(+) create mode 100644 recipes-networking/dnsmasq/dnsmasq/CVE-2017-14496.patch diff --git a/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14496.patch b/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14496.patch new file mode 100644 index 0000000..333a890 --- /dev/null +++ b/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14496.patch @@ -0,0 +1,94 @@ +From 897c113fda0886a28a986cc6ba17bb93bd6cb1c7 Mon Sep 17 00:00:00 2001 +From: Simon Kelley +Date: Mon, 25 Sep 2017 20:11:58 +0100 +Subject: [PATCH] Security fix, CVE-2017-14496, Integer underflow in DNS + response creation. + +Fix DoS in DNS. Invalid boundary checks in the +add_pseudoheader function allows a memcpy call with negative +size An attacker which can send malicious DNS queries +to dnsmasq can trigger a DoS remotely. +dnsmasq is vulnerable only if one of the following option is +specified: --add-mac, --add-cpe-id or --add-subnet. + +CVE: CVE-2017-14496 +Upstream-Status: Backport + +Signed-off-by: Sona Sarmadi +--- + CHANGELOG | 11 +++++++++++ + src/edns0.c | 13 ++++++++++++- + 2 files changed, 23 insertions(+), 1 deletion(-) + +diff --git a/CHANGELOG b/CHANGELOG +index d1cc074..8fe00ed 100644 +--- a/CHANGELOG ++++ b/CHANGELOG +@@ -60,6 +60,17 @@ version 2.78 + and Kevin Hamacher of the Google Security Team for + finding this. + ++ Fix DoS in DNS. Invalid boundary checks in the ++ add_pseudoheader function allows a memcpy call with negative ++ size An attacker which can send malicious DNS queries ++ to dnsmasq can trigger a DoS remotely. ++ dnsmasq is vulnerable only if one of the following option is ++ specified: --add-mac, --add-cpe-id or --add-subnet. ++ CVE-2017-14496 applies. ++ Credit to Felix Wilhelm, Fermin J. Serna, Gabriel Campana ++ and Kevin Hamacher of the Google Security Team for ++ finding this. ++ + + version 2.77 + Generate an error when configured with a CNAME loop, +diff --git a/src/edns0.c b/src/edns0.c +index f5b798c..95b74ee 100644 +--- a/src/edns0.c ++++ b/src/edns0.c +@@ -144,7 +144,7 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l + GETSHORT(len, p); + + /* malformed option, delete the whole OPT RR and start again. */ +- if (i + len > rdlen) ++ if (i + 4 + len > rdlen) + { + rdlen = 0; + is_last = 0; +@@ -193,6 +193,8 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l + ntohs(header->ancount) + ntohs(header->nscount) + ntohs(header->arcount), + header, plen))) + return plen; ++ if (p + 11 > limit) ++ return plen; /* Too big */ + *p++ = 0; /* empty name */ + PUTSHORT(T_OPT, p); + PUTSHORT(udp_sz, p); /* max packet length, 512 if not given in EDNS0 header */ +@@ -204,6 +206,11 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l + /* Copy back any options */ + if (buff) + { ++ if (p + rdlen > limit) ++ { ++ free(buff); ++ return plen; /* Too big */ ++ } + memcpy(p, buff, rdlen); + free(buff); + p += rdlen; +@@ -220,8 +227,12 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l + /* Add new option */ + if (optno != 0 && replace != 2) + { ++ if (p + 4 > limit) ++ return plen; /* Too big */ + PUTSHORT(optno, p); + PUTSHORT(optlen, p); ++ if (p + optlen > limit) ++ return plen; /* Too big */ + memcpy(p, opt, optlen); + p += optlen; + PUTSHORT(p - datap, lenp); +-- +1.7.10.4 + diff --git a/recipes-networking/dnsmasq/dnsmasq_%.bbappend b/recipes-networking/dnsmasq/dnsmasq_%.bbappend index c0c4633..07f8a6c 100644 --- a/recipes-networking/dnsmasq/dnsmasq_%.bbappend +++ b/recipes-networking/dnsmasq/dnsmasq_%.bbappend @@ -6,4 +6,5 @@ SRC_URI += "file://0001-CVE-2017-14491.patch \ file://CVE-2017-14492.patch \ file://CVE-2017-14493.patch \ file://CVE-2017-14494.patch \ + file://CVE-2017-14496.patch \ " -- cgit v1.2.3-54-g00ecf