dnsmasq: CVE-2017-14496

Invalid boundary checks here. Integer underflow leading to a huge memcpy.

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-14496
https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Adrian Dudau <adrian.dudau@enea.com>

2 files changed, 95 insertions, 0 deletions

diff --git a/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14496.patch b/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14496.patch
new file mode 100644
index 0000000..333a890
--- /dev/null
+++ b/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14496.patch
@@ -0,0 +1,94 @@
+From 897c113fda0886a28a986cc6ba17bb93bd6cb1c7 Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Mon, 25 Sep 2017 20:11:58 +0100
+Subject: [PATCH] Security fix, CVE-2017-14496, Integer underflow in DNS
+ response creation.
+
+Fix DoS in DNS. Invalid boundary checks in the
+add_pseudoheader function allows a memcpy call with negative
+size An attacker which can send malicious DNS queries
+to dnsmasq can trigger a DoS remotely.
+dnsmasq is vulnerable only if one of the following option is
+specified: --add-mac, --add-cpe-id or --add-subnet.
+
+CVE: CVE-2017-14496
+Upstream-Status: Backport
+
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ CHANGELOG   |   11 +++++++++++
+ src/edns0.c |   13 ++++++++++++-
+ 2 files changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/CHANGELOG b/CHANGELOG
+index d1cc074..8fe00ed 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -60,6 +60,17 @@ version 2.78
+        and Kevin Hamacher of the Google Security Team for
+        finding this.
+        
++       Fix DoS in DNS. Invalid boundary checks in the
++       add_pseudoheader function allows a memcpy call with negative
++       size An attacker which can send malicious DNS queries
++       to dnsmasq can trigger a DoS remotely.
++       dnsmasq is vulnerable only if one of the following option is
++       specified: --add-mac, --add-cpe-id or --add-subnet.
++       CVE-2017-14496 applies.
++       Credit to Felix Wilhelm, Fermin J. Serna, Gabriel Campana
++       and Kevin Hamacher of the Google Security Team for
++       finding this.
++       
+        
+ version 2.77
+        Generate an error when configured with a CNAME loop,
+diff --git a/src/edns0.c b/src/edns0.c
+index f5b798c..95b74ee 100644
+--- a/src/edns0.c
++++ b/src/edns0.c
+@@ -144,7 +144,7 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
+          GETSHORT(len, p);
+          
+          /* malformed option, delete the whole OPT RR and start again. */
+-         if (i + len > rdlen)
++         if (i + 4 + len > rdlen)
+            {
+              rdlen = 0;
+              is_last = 0;
+@@ -193,6 +193,8 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
+                             ntohs(header->ancount) + ntohs(header->nscount) + ntohs(header->arcount), 
+                             header, plen)))
+        return plen;
++      if (p + 11 > limit)
++       return plen; /* Too big */
+       *p++ = 0; /* empty name */
+       PUTSHORT(T_OPT, p);
+       PUTSHORT(udp_sz, p); /* max packet length, 512 if not given in EDNS0 header */
+@@ -204,6 +206,11 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
+       /* Copy back any options */
+       if (buff)
+        {
++          if (p + rdlen > limit)
++          {
++            free(buff);
++            return plen; /* Too big */
++          }
+          memcpy(p, buff, rdlen);
+          free(buff);
+          p += rdlen;
+@@ -220,8 +227,12 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
+   /* Add new option */
+   if (optno != 0 && replace != 2)
+     {
++      if (p + 4 > limit)
++       return plen; /* Too big */
+       PUTSHORT(optno, p);
+       PUTSHORT(optlen, p);
++      if (p + optlen > limit)
++       return plen; /* Too big */
+       memcpy(p, opt, optlen);
+       p += optlen;  
+       PUTSHORT(p - datap, lenp);
+-- 
+1.7.10.4
+
diff --git a/recipes-networking/dnsmasq/dnsmasq_%.bbappend b/recipes-networking/dnsmasq/dnsmasq_%.bbappend
index c0c4633..07f8a6c 100644
--- a/recipes-networking/dnsmasq/dnsmasq_%.bbappend
+++ b/recipes-networking/dnsmasq/dnsmasq_%.bbappend
@@ -6,4 +6,5 @@ SRC_URI += "file://0001-CVE-2017-14491.patch \
     file://CVE-2017-14492.patch \
     file://CVE-2017-14493.patch \
     file://CVE-2017-14494.patch \
+    file://CVE-2017-14496.patch \
 "