summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHitendra Prajapati <hprajapati@mvista.com>2024-04-04 10:11:40 +0530
committerArmin Kuster <akuster808@gmail.com>2024-04-25 08:27:27 -0400
commit01358b6d705071cc0ac5aefa7670ab235709729a (patch)
treeab07dad623dd5966c53473915455eb246d3b7dc6
parent6e702707c320a12a91c85a4627f99db607d42f55 (diff)
downloadmeta-openembedded-dunfell-next.tar.gz
wireshark: fix CVE-2023-6175dunfell-nextdunfell
Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/3be1c99180a6fc48c34ae4bfc79bfd840b29ae3e Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
Diffstat
-rw-r--r--meta-networking/recipes-support/wireshark/files/CVE-2023-6175.patch246
-rw-r--r--meta-networking/recipes-support/wireshark/wireshark_3.2.18.bb1
2 files changed, 247 insertions, 0 deletions
diff --git a/meta-networking/recipes-support/wireshark/files/CVE-2023-6175.patch b/meta-networking/recipes-support/wireshark/files/CVE-2023-6175.patch
new file mode 100644
index 0000000000..a08610f8d2
--- /dev/null
+++ b/meta-networking/recipes-support/wireshark/files/CVE-2023-6175.patch
@@ -0,0 +1,246 @@
1From 2d59b26d3b554960c777003c431add89d018b0a6 Mon Sep 17 00:00:00 2001
2From: Guy Harris <gharris@sonic.net>
3Date: Tue, 17 Oct 2023 22:08:42 -0700
4Subject: [PATCH] netscreen: do bounds checking for each byte of packet data.
5
6Make sure each byte we add to the packet data from the file fits in the
7buffer, rather than stuffing bytes into the buffer and checking
8afterwards.
9
10This prevents a buffer overflow.
11
12Fixes #19404, which was filed as part of Trend Micro's Zero Day
13Initiative as ZDI-CAN-22164.
14
15While we're at it, expand a comment and make error messages give some
16more detail.
17
18Upstream-Status: Backport [https://gitlab.com/wireshark/wireshark/-/commit/3be1c99180a6fc48c34ae4bfc79bfd840b29ae3e]
19CVE: CVE-2023-6175
20Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
21---
22 wiretap/netscreen.c | 125 +++++++++++++++++++++++++++++++++-----------
23 1 file changed, 94 insertions(+), 31 deletions(-)
24
25diff --git a/wiretap/netscreen.c b/wiretap/netscreen.c
26index 9ad825f..ffcb689 100644
27--- a/wiretap/netscreen.c
28+++ b/wiretap/netscreen.c
29@@ -59,7 +59,12 @@ static gboolean netscreen_seek_read(wtap *wth, gint64 seek_off,
30 static gboolean parse_netscreen_packet(FILE_T fh, wtap_rec *rec,
31 Buffer* buf, char *line, int *err, gchar **err_info);
32 static int parse_single_hex_dump_line(char* rec, guint8 *buf,
33- guint byte_offset);
34+ guint byte_offset, guint pkt_len);
35+
36+/* Error returns from parse_single_hex_dump_line() */
37+#define PARSE_LINE_INVALID_CHARACTER -1
38+#define PARSE_LINE_NO_BYTES_SEEN -2
39+#define PARSE_LINE_TOO_MANY_BYTES_SEEN -3
40
41 /* Returns TRUE if the line appears to be a line with protocol info.
42 Otherwise it returns FALSE. */
43@@ -241,13 +246,40 @@ netscreen_seek_read(wtap *wth, gint64 seek_off, wtap_rec *rec, Buffer *buf,
44 2c 21 b6 d3 20 60 0c 8c 35 98 88 cf 20 91 0e a9 ,!...`..5.......
45 1d 0b ..
46
47+ * The first line of a packet is in the form
48+
49+<secs>.<dsecs>: <iface>({i,o}) len=<length>:<llinfo>>
50
51+ * where:
52+ *
53+ * <secs> and <dsecs> are a time stamp in seconds and deciseconds,
54+ * giving the time since the firewall was booted;
55+ *
56+ * <iface> is the name of the interface on which the packet was
57+ * received or on which it was transmitted;
58+ *
59+ * {i,o} is i for a received packet and o for a transmitted packet;
60+ *
61+ * <length> is the length of the packet on the network;
62+ *
63+ * <llinfo>, at least for Ethernet, appears to be a source MAC
64+ * address, folowed by "->", folowed by a destination MAC
65+ * address, followed by a sequence of Ethertypes, each
66+ * preceded by a "/" (multiple Ethertypes if there are VLAN
67+ * tags and the like), possibly followed by ", tag <tag>".
68+ *
69+ * Following that may be some "info lines", each of which is indented
70+ * by 14 spaces, giving a dissection of the payload after the
71+ * link-layer header.
72+ *
73+ * Following that is a hex/ASCII dump of the contents of the
74+ * packet, with 16 octets per line.
75 */
76 static gboolean
77 parse_netscreen_packet(FILE_T fh, wtap_rec *rec, Buffer* buf,
78 char *line, int *err, gchar **err_info)
79 {
80- int pkt_len;
81+ guint pkt_len;
82 int sec;
83 int dsec;
84 char cap_int[NETSCREEN_MAX_INT_NAME_LENGTH];
85@@ -266,17 +298,12 @@ parse_netscreen_packet(FILE_T fh, wtap_rec *rec, Buffer* buf,
86 memset(cap_int, 0, sizeof(cap_int));
87 memset(cap_dst, 0, sizeof(cap_dst));
88
89- if (sscanf(line, "%9d.%9d: %15[a-z0-9/:.-](%1[io]) len=%9d:%12s->%12s/",
90+ if (sscanf(line, "%9d.%9d: %15[a-z0-9/:.-](%1[io]) len=%9u:%12s->%12s/",
91 &sec, &dsec, cap_int, direction, &pkt_len, cap_src, cap_dst) < 5) {
92 *err = WTAP_ERR_BAD_FILE;
93 *err_info = g_strdup("netscreen: Can't parse packet-header");
94 return -1;
95 }
96- if (pkt_len < 0) {
97- *err = WTAP_ERR_BAD_FILE;
98- *err_info = g_strdup("netscreen: packet header has a negative packet length");
99- return FALSE;
100- }
101 if (pkt_len > WTAP_MAX_PACKET_SIZE_STANDARD) {
102 /*
103 * Probably a corrupt capture file; don't blow up trying
104@@ -323,44 +350,71 @@ parse_netscreen_packet(FILE_T fh, wtap_rec *rec, Buffer* buf,
105 break;
106 }
107
108- n = parse_single_hex_dump_line(p, pd, offset);
109+ n = parse_single_hex_dump_line(p, pd, offset, pkt_len);
110
111- /* the smallest packet has a length of 6 bytes, if
112- * the first hex-data is less then check whether
113- * it is a info-line and act accordingly
114+ /*
115+ * The smallest packet has a length of 6 bytes.
116+ * If the first line either gets an error when
117+ * parsed as hex data, or has fewer than 6
118+ * bytes of hex data, check whether it's an
119+ * info line by see if it has at least
120+ * NETSCREEN_SPACES_ON_INFO_LINE spaces at the
121+ * beginning.
122+ *
123+ * If it does, count this line and, if we have,
124+ * so far, skipped no more than NETSCREEN_MAX_INFOLINES
125+ * lines, skip this line.
126 */
127 if (offset == 0 && n < 6) {
128 if (info_line(line)) {
129+ /* Info line */
130 if (++i <= NETSCREEN_MAX_INFOLINES) {
131+ /* Skip this line */
132 continue;
133 }
134 } else {
135- *err = WTAP_ERR_BAD_FILE;
136- *err_info = g_strdup("netscreen: cannot parse hex-data");
137- return FALSE;
138+ if (n >= 0) {
139+ *err = WTAP_ERR_BAD_FILE;
140+ *err_info = g_strdup("netscreen: first line of packet data has only %d hex bytes, < 6");
141+ return FALSE;
142+ }
143+ /* Otherwise, fall through to report error */
144 }
145 }
146
147 /* If there is no more data and the line was not empty,
148 * then there must be an error in the file
149 */
150- if (n == -1) {
151- *err = WTAP_ERR_BAD_FILE;
152- *err_info = g_strdup("netscreen: cannot parse hex-data");
153+ if (n < 0) {
154+ switch (n) {
155+
156+ case PARSE_LINE_INVALID_CHARACTER:
157+ *err = WTAP_ERR_BAD_FILE;
158+ *err_info = g_strdup("netscreen: invalid character in hex data");
159+ break;
160+
161+ case PARSE_LINE_NO_BYTES_SEEN:
162+ *err = WTAP_ERR_BAD_FILE;
163+ *err_info = g_strdup("netscreen: no hex bytes seen in hex data");
164+ break;
165+
166+ case PARSE_LINE_TOO_MANY_BYTES_SEEN:
167+ *err = WTAP_ERR_BAD_FILE;
168+ *err_info = g_strdup("netscreen: number of hex bytes seen in hex data is greater than the packet length");
169+ break;
170+
171+ default:
172+ *err = WTAP_ERR_INTERNAL;
173+ *err_info = g_strdup_printf("netscreen: unknown error %d from parse_single_hex_dump_line()", n);
174+ break;
175+ }
176+
177 return FALSE;
178 }
179
180 /* Adjust the offset to the data that was just added to the buffer */
181 offset += n;
182
183- /* If there was more hex-data than was announced in the len=x
184- * header, then then there must be an error in the file
185- */
186- if (offset > pkt_len) {
187- *err = WTAP_ERR_BAD_FILE;
188- *err_info = g_strdup("netscreen: too much hex-data");
189- return FALSE;
190- }
191 }
192
193 /*
194@@ -400,7 +454,7 @@ parse_netscreen_packet(FILE_T fh, wtap_rec *rec, Buffer* buf,
195 *
196 * Returns number of bytes successfully read, -1 if bad. */
197 static int
198-parse_single_hex_dump_line(char* rec, guint8 *buf, guint byte_offset)
199+parse_single_hex_dump_line(char* rec, guint8 *buf, guint byte_offset, guint pkt_len)
200 {
201 int num_items_scanned;
202 guint8 character;
203@@ -419,7 +473,7 @@ parse_single_hex_dump_line(char* rec, guint8 *buf, guint byte_offset)
204 /* Nothing more to parse */
205 break;
206 } else
207- return -1; /* not a hex digit, space before ASCII dump, or EOL */
208+ return PARSE_LINE_INVALID_CHARACTER; /* not a hex digit, space before ASCII dump, or EOL */
209 byte <<= 4;
210 character = *rec++ & 0xFF;
211 if (character >= '0' && character <= '9')
212@@ -429,7 +483,16 @@ parse_single_hex_dump_line(char* rec, guint8 *buf, guint byte_offset)
213 else if (character >= 'a' && character <= 'f')
214 byte += character - 'a' + 0xa;
215 else
216- return -1; /* not a hex digit */
217+ return PARSE_LINE_INVALID_CHARACTER; /* not a hex digit */
218+
219+ /* If there was more hex-data than was announced in the len=x
220+ * header, then there must be an error in the file; quit
221+ * now, as adding this byte will overflow the buffer.
222+ */
223+ if (byte_offset + num_items_scanned >= pkt_len) {
224+ return PARSE_LINE_TOO_MANY_BYTES_SEEN;
225+ }
226+
227 buf[byte_offset + num_items_scanned] = byte;
228 character = *rec++ & 0xFF;
229 if (character == '\0' || character == '\r' || character == '\n') {
230@@ -437,11 +500,11 @@ parse_single_hex_dump_line(char* rec, guint8 *buf, guint byte_offset)
231 break;
232 } else if (character != ' ') {
233 /* not space before ASCII dump */
234- return -1;
235+ return PARSE_LINE_INVALID_CHARACTER;
236 }
237 }
238 if (num_items_scanned == 0)
239- return -1;
240+ return PARSE_LINE_NO_BYTES_SEEN;
241
242 return num_items_scanned;
243 }
244--
2452.25.1
246
diff --git a/meta-networking/recipes-support/wireshark/wireshark_3.2.18.bb b/meta-networking/recipes-support/wireshark/wireshark_3.2.18.bb
index 534b1a2f36..4e48d5294c 100644
--- a/meta-networking/recipes-support/wireshark/wireshark_3.2.18.bb
+++ b/meta-networking/recipes-support/wireshark/wireshark_3.2.18.bb
@@ -25,6 +25,7 @@ SRC_URI = "https://1.eu.dl.wireshark.org/src/all-versions/wireshark-${PV}.tar.xz
25 file://CVE-2023-1992.patch \ 25 file://CVE-2023-1992.patch \
26 file://CVE-2023-4511.patch \ 26 file://CVE-2023-4511.patch \
27 file://CVE-2024-2955.patch \ 27 file://CVE-2024-2955.patch \
28 file://CVE-2023-6175.patch \
28 " 29 "
29UPSTREAM_CHECK_URI = "https://1.as.dl.wireshark.org/src" 30UPSTREAM_CHECK_URI = "https://1.as.dl.wireshark.org/src"
30 31
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-04-03 23:16:02 +0000