Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP2:Update
qemu
0380-slirp-check-pkt_len-before-reading-.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 0380-slirp-check-pkt_len-before-reading-.patch of Package qemu
From: Prasad J Pandit <pjp@fedoraproject.org> Date: Thu, 26 Nov 2020 19:27:06 +0530 Subject: slirp: check pkt_len before reading protocol header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Git-commit: 2e1dcbc0c2af64fcb17009eaf2ceedd81be2b27f References: bsc#1179467 While processing ARP/NCSI packets in 'arp_input' or 'ncsi_input' routines, ensure that pkt_len is large enough to accommodate the respective protocol headers, lest it should do an OOB access. Add check to avoid it. CVE-2020-29129 CVE-2020-29130 QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets -> https://www.openwall.com/lists/oss-security/2020/11/27/1 Reported-by: Qiuhao Li <Qiuhao.Li@outlook.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <20201126135706.273950-1-ppandit@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Bruce Rogers <brogers@suse.com> [BR: no NCSI code, so only ARP patched] --- slirp/slirp.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/slirp/slirp.c b/slirp/slirp.c index 9f4bea3d3bf6765b81d1b317c9e1..da4c2eb6c2bb13c690538f4d7200 100644 --- a/slirp/slirp.c +++ b/slirp/slirp.c @@ -712,6 +712,10 @@ static void arp_input(Slirp *slirp, const uint8_t *pkt, int pkt_len) return; } + if (pkt_len < ETH_HLEN + sizeof(struct arphdr)) { + return; /* packet too short */ + } + ar_op = ntohs(ah->ar_op); switch(ar_op) { case ARPOP_REQUEST:
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor