From d75aef2c018c25bc0cae56d42598fdee673d1ba5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 26 Sep 2017 17:57:45 +0200 Subject: [PATCH] Security fix, CVE-2017-14496, Integer underflow in DNS response creation. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fix DoS in DNS. Invalid boundary checks in the add_pseudoheader function allows a memcpy call with negative size An attacker which can send malicious DNS queries to dnsmasq can trigger a DoS remotely. dnsmasq is vulnerable only if one of the following option is specified: --add-mac, --add-cpe-id or --add-subnet. Signed-off-by: Petr Menšík --- dnsmasq-2.77-CVE-2017-14496.patch | 66 +++++++++++++++++++++++++++++++ dnsmasq.spec | 3 ++ 2 files changed, 69 insertions(+) create mode 100644 dnsmasq-2.77-CVE-2017-14496.patch diff --git a/dnsmasq-2.77-CVE-2017-14496.patch b/dnsmasq-2.77-CVE-2017-14496.patch new file mode 100644 index 0000000..36420e8 --- /dev/null +++ b/dnsmasq-2.77-CVE-2017-14496.patch @@ -0,0 +1,66 @@ +From 897c113fda0886a28a986cc6ba17bb93bd6cb1c7 Mon Sep 17 00:00:00 2001 +From: Simon Kelley +Date: Mon, 25 Sep 2017 20:11:58 +0100 +Subject: [PATCH 6/9] Security fix, CVE-2017-14496, Integer underflow in DNS + response creation. + +Fix DoS in DNS. Invalid boundary checks in the +add_pseudoheader function allows a memcpy call with negative +size An attacker which can send malicious DNS queries +to dnsmasq can trigger a DoS remotely. +dnsmasq is vulnerable only if one of the following option is +specified: --add-mac, --add-cpe-id or --add-subnet. +--- + src/edns0.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/src/edns0.c b/src/edns0.c +index f5b798c..95b74ee 100644 +--- a/src/edns0.c ++++ b/src/edns0.c +@@ -144,7 +144,7 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l + GETSHORT(len, p); + + /* malformed option, delete the whole OPT RR and start again. */ +- if (i + len > rdlen) ++ if (i + 4 + len > rdlen) + { + rdlen = 0; + is_last = 0; +@@ -193,6 +193,8 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l + ntohs(header->ancount) + ntohs(header->nscount) + ntohs(header->arcount), + header, plen))) + return plen; ++ if (p + 11 > limit) ++ return plen; /* Too big */ + *p++ = 0; /* empty name */ + PUTSHORT(T_OPT, p); + PUTSHORT(udp_sz, p); /* max packet length, 512 if not given in EDNS0 header */ +@@ -204,6 +206,11 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l + /* Copy back any options */ + if (buff) + { ++ if (p + rdlen > limit) ++ { ++ free(buff); ++ return plen; /* Too big */ ++ } + memcpy(p, buff, rdlen); + free(buff); + p += rdlen; +@@ -220,8 +227,12 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l + /* Add new option */ + if (optno != 0 && replace != 2) + { ++ if (p + 4 > limit) ++ return plen; /* Too big */ + PUTSHORT(optno, p); + PUTSHORT(optlen, p); ++ if (p + optlen > limit) ++ return plen; /* Too big */ + memcpy(p, opt, optlen); + p += optlen; + PUTSHORT(p - datap, lenp); +-- +2.9.5 + diff --git a/dnsmasq.spec b/dnsmasq.spec index a3a437d..0e99f7b 100644 --- a/dnsmasq.spec +++ b/dnsmasq.spec @@ -27,6 +27,7 @@ Patch2: dnsmasq-2.77-CVE-2017-14491.patch Patch3: dnsmasq-2.77-CVE-2017-14492.patch Patch4: dnsmasq-2.77-CVE-2017-14493.patch Patch5: dnsmasq-2.77-CVE-2017-14494.patch +Patch6: dnsmasq-2.77-CVE-2017-14496.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) @@ -66,6 +67,7 @@ query/remove a DHCP server's leases. %patch3 -p1 -b .CVE-2017-14492 %patch4 -p1 -b .CVE-2017-14493 %patch5 -p1 -b .CVE-2017-14494 +%patch6 -p1 -b .CVE-2017-14496 # use /var/lib/dnsmasq instead of /var/lib/misc for file in dnsmasq.conf.example man/dnsmasq.8 man/es/dnsmasq.8 src/config.h; do @@ -157,6 +159,7 @@ rm -rf $RPM_BUILD_ROOT - Security fix, CVE-2017-14492, DHCPv6 RA heap overflow - Security fix, CVE-2017-14493, DHCPv6 - Stack buffer overflow - Security fix, CVE-2017-14494, Infoleak handling DHCPv6 +- Security fix, CVE-2017-14496, Integer underflow in DNS response creation * Thu Sep 14 2017 Petr Menšík - 2.77-7 - Fix CVE-2017-13704