Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP5:Update
xen.23585
CVE-2020-29130-qemut-out-of-bounds-access-while...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2020-29130-qemut-out-of-bounds-access-while-processing-ARP-packets.patch of Package xen.23585
While processing ARP/NCSI packets in 'arp_input' or 'ncsi_input' routines, ensure that pkt_len is large enough to accommodate the respective protocol headers, lest it should do an OOB access. Add check to avoid it. Reported-by: Qiuhao Li <Qiuhao.Li at outlook.com> Signed-off-by: Prasad J Pandit <pjp at fedoraproject.org> --- src/ncsi.c | 4 ++++ src/slirp.c | 4 ++++ 2 files changed, 8 insertions(+) Index: xen-4.11.4-testing/tools/qemu-xen-traditional-dir-remote/slirp/slirp.c =================================================================== --- xen-4.11.4-testing.orig/tools/qemu-xen-traditional-dir-remote/slirp/slirp.c +++ xen-4.11.4-testing/tools/qemu-xen-traditional-dir-remote/slirp/slirp.c @@ -604,6 +604,10 @@ static void arp_input(const uint8_t *pkt int ar_op; struct ex_list *ex_ptr; + if (pkt_len < ETH_HLEN + sizeof(struct arphdr)) { + return; /* packet too short */ + } + ar_op = ntohs(ah->ar_op); switch(ar_op) { case ARPOP_REQUEST:
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
