File 0005-Fix-remotely-triggerable-ASSERT-on-malform... of Package openvpn

Overview Repositories Revisions Requests Users Attributes Meta

File 0005-Fix-remotely-triggerable-ASSERT-on-malformed-IPv6-pa.patch of Package openvpn (Revision e6493368c011facfd301d7cd30e9982f)

Currently displaying revision e6493368c011facfd301d7cd30e9982f , Show latest

From fc61d1bda112ffc669dbde961fab19f60b3c7439 Mon Sep 17 00:00:00 2001
From: Gert Doering <gert@greenie.muc.de>
Date: Tue, 13 Jun 2017 22:08:32 +0200
Subject: [PATCH 5/5] Fix remotely-triggerable ASSERT() on malformed IPv6
 packet.

Correct sanity checks on IPv6 packet length in mss_fixup_ipv6(),
and change the ASSERT() check in mss_fixup_dowork() into a simple
"return" (= the TCP header will simply not be inspected further).

CVE-2017-7508 has been assigned due to the serious nature of the
bug: it can be used to remotely shutdown an openvpn server or
client, if IPv6 and --mssfix are enabled and the IPv6 networks used
inside the VPN are known.

Found by Guido Vranken <guidovranken@gmail.com>.

v2: style changes

CVE: 2017-7508
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <20170613200832.15027-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/search?l=mid&q=20170613200832.15027-1-gert@greenie.muc.de
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit c3f47077a7756de5929094569421a95aa66f2022)
---
 src/openvpn/mss.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/openvpn/mss.c b/src/openvpn/mss.c
index f930942a..c91751d1 100644
--- a/src/openvpn/mss.c
+++ b/src/openvpn/mss.c
@@ -110,8 +110,12 @@ mss_fixup_ipv6 (struct buffer *buf, int maxmss)
   if ( pip6->nexthdr != OPENVPN_IPPROTO_TCP )
     return;
 
+  /* skip IPv6 header (40 bytes),
+   * verify remainder is large enough to contain a full TCP header
+   */
   newbuf = *buf;
-  if ( buf_advance( &newbuf, 40 ) )
+  if (buf_advance( &newbuf, 40 )
+      && BLEN(&newbuf) >= (int) sizeof(struct openvpn_tcphdr))
     {
       struct openvpn_tcphdr *tc = (struct openvpn_tcphdr *) BPTR (&newbuf);
       if (tc->flags & OPENVPN_TCPH_SYN_MASK)
@@ -133,7 +137,10 @@ mss_fixup_dowork (struct buffer *buf, uint16_t maxmss)
   int accumulate;
   struct openvpn_tcphdr *tc;
 
-  ASSERT (BLEN (buf) >= (int) sizeof (struct openvpn_tcphdr));
+  if (BLEN(buf) < (int) sizeof(struct openvpn_tcphdr))
+    {
+	return;
+    }
 
   verify_align_4 (buf);
   tc = (struct openvpn_tcphdr *) BPTR (buf);
-- 
2.13.1

Places

File 0005-Fix-remotely-triggerable-ASSERT-on-malformed-IPv6-pa.patch of Package openvpn (Revision e6493368c011facfd301d7cd30e9982f)

Places