Resolves: RHEL-32128 - infinite loop
This commit is contained in:
parent
3536ef0396
commit
8b24d2e071
156
0007-CVE-2024-31949.patch
Normal file
156
0007-CVE-2024-31949.patch
Normal file
@ -0,0 +1,156 @@
|
||||
From 2a5ea423efe179c018b836a1c5a256c93ae429ef Mon Sep 17 00:00:00 2001
|
||||
From: Donatas Abraitis <donatas@opensourcerouting.org>
|
||||
Date: Sat, 30 Mar 2024 15:35:18 +0200
|
||||
Subject: [PATCH] bgpd: Fix errors handling for MP/GR capabilities as dynamic
|
||||
capability
|
||||
|
||||
When receiving a MP/GR capability as dynamic capability, but malformed, do not
|
||||
forget to advance the pointer to avoid hitting infinity loop.
|
||||
|
||||
After:
|
||||
```
|
||||
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [GS0AQ-HKY0X] 127.0.0.1 rcv CAPABILITY
|
||||
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 5, length 0
|
||||
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 0, length 0
|
||||
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [HFHDS-QT71N][EC 33554494] 127.0.0.1(donatas-pc): unrecognized capability code: 0 - ignored
|
||||
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 0, code: 0, length 0
|
||||
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [HFHDS-QT71N][EC 33554494] 127.0.0.1(donatas-pc): unrecognized capability code: 0 - ignored
|
||||
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 0, code: 0, length 0
|
||||
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [HFHDS-QT71N][EC 33554494] 127.0.0.1(donatas-pc): unrecognized capability code: 0 - ignored
|
||||
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 0, code: 0, length 1
|
||||
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [HFHDS-QT71N][EC 33554494] 127.0.0.1(donatas-pc): unrecognized capability code: 0 - ignored
|
||||
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||
```
|
||||
|
||||
Before:
|
||||
```
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||
```
|
||||
|
||||
Reported-by: Iggy Frankovic <iggyfran@amazon.com>
|
||||
Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
|
||||
(cherry picked from commit 30a332dad86fafd2b0b6c61d23de59ed969a219b)
|
||||
---
|
||||
bgpd/bgp_packet.c | 17 ++++++++++-------
|
||||
1 file changed, 10 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/bgpd/bgp_packet.c b/bgpd/bgp_packet.c
|
||||
index 7d6a6b55e8d8..1f808eea725a 100644
|
||||
--- a/bgpd/bgp_packet.c
|
||||
+++ b/bgpd/bgp_packet.c
|
||||
@@ -3610,6 +3610,7 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
|
||||
zlog_err("%pBP: Capability length error", peer);
|
||||
bgp_notify_send(peer->connection, BGP_NOTIFY_CEASE,
|
||||
BGP_NOTIFY_SUBCODE_UNSPECIFIC);
|
||||
+ pnt += length;
|
||||
return BGP_Stop;
|
||||
}
|
||||
action = *pnt;
|
||||
@@ -3622,7 +3623,7 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
|
||||
action);
|
||||
bgp_notify_send(peer->connection, BGP_NOTIFY_CEASE,
|
||||
BGP_NOTIFY_SUBCODE_UNSPECIFIC);
|
||||
- return BGP_Stop;
|
||||
+ goto done;
|
||||
}
|
||||
|
||||
if (bgp_debug_neighbor_events(peer))
|
||||
@@ -3634,12 +3635,13 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
|
||||
zlog_err("%pBP: Capability length error", peer);
|
||||
bgp_notify_send(peer->connection, BGP_NOTIFY_CEASE,
|
||||
BGP_NOTIFY_SUBCODE_UNSPECIFIC);
|
||||
+ pnt += length;
|
||||
return BGP_Stop;
|
||||
}
|
||||
|
||||
/* Ignore capability when override-capability is set. */
|
||||
if (CHECK_FLAG(peer->flags, PEER_FLAG_OVERRIDE_CAPABILITY))
|
||||
- continue;
|
||||
+ goto done;
|
||||
|
||||
capability = lookup_msg(capcode_str, hdr->code, "Unknown");
|
||||
|
||||
@@ -3654,7 +3656,7 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
|
||||
peer, capability,
|
||||
sizeof(struct capability_mp_data),
|
||||
hdr->length);
|
||||
- return BGP_Stop;
|
||||
+ goto done;
|
||||
}
|
||||
|
||||
memcpy(&mpc, pnt + 3, sizeof(struct capability_mp_data));
|
||||
@@ -3669,7 +3671,7 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
|
||||
peer, capability,
|
||||
iana_afi2str(pkt_afi),
|
||||
iana_safi2str(pkt_safi));
|
||||
- continue;
|
||||
+ goto done;
|
||||
}
|
||||
|
||||
/* Address family check. */
|
||||
@@ -3696,7 +3698,7 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
|
||||
if (peer_active_nego(peer))
|
||||
bgp_clear_route(peer, afi, safi);
|
||||
else
|
||||
- return BGP_Stop;
|
||||
+ goto done;
|
||||
}
|
||||
break;
|
||||
case CAPABILITY_CODE_RESTART:
|
||||
@@ -3706,7 +3708,7 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
|
||||
bgp_notify_send(peer->connection,
|
||||
BGP_NOTIFY_CEASE,
|
||||
BGP_NOTIFY_SUBCODE_UNSPECIFIC);
|
||||
- return BGP_Stop;
|
||||
+ goto done;
|
||||
}
|
||||
|
||||
bgp_dynamic_capability_graceful_restart(pnt, action,
|
||||
@@ -3738,7 +3740,7 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
|
||||
bgp_notify_send(peer->connection,
|
||||
BGP_NOTIFY_CEASE,
|
||||
BGP_NOTIFY_SUBCODE_UNSPECIFIC);
|
||||
- return BGP_Stop;
|
||||
+ goto done;
|
||||
}
|
||||
|
||||
uint8_t role;
|
||||
@@ -3760,6 +3762,7 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
|
||||
break;
|
||||
}
|
||||
|
||||
+done:
|
||||
pnt += hdr->length + 3;
|
||||
}
|
||||
|
8
frr.spec
8
frr.spec
@ -9,7 +9,7 @@
|
||||
|
||||
Name: frr
|
||||
Version: 9.1
|
||||
Release: 5%{?dist}
|
||||
Release: 6%{?dist}
|
||||
Summary: Routing daemon
|
||||
License: GPL-2.0-or-later AND ISC AND LGPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND (GPL-2.0-or-later OR ISC) AND MIT
|
||||
URL: http://www.frrouting.org
|
||||
@ -27,6 +27,7 @@ Patch0003: 0003-disable-eigrp-crypto.patch
|
||||
Patch0004: 0004-fips-mode.patch
|
||||
Patch0005: 0005-remove-grpc-test.patch
|
||||
Patch0006: 0006-CVE-2024-31948.patch
|
||||
Patch0007: 0007-CVE-2024-31949.patch
|
||||
|
||||
BuildRequires: autoconf
|
||||
BuildRequires: automake
|
||||
@ -277,8 +278,11 @@ rm tests/lib/*grpc*
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Thu Apr 18 2024 Michal Ruprich <mruprich@redhat.com> - 9.1-6
|
||||
- Resolves: RHEL-32128 - infinite loop
|
||||
|
||||
* Thu Apr 18 2024 Michal Ruprich <mruprich@redhat.com> - 9.1-5
|
||||
- Resolves: #RHEL-32125 - bgpd daemon crash
|
||||
- Resolves: RHEL-32125 - bgpd daemon crash
|
||||
|
||||
* Tue Apr 16 2024 Michal Ruprich <mruprich@redhat.com> - 9.1-4
|
||||
- Moving yang modules to an frr specific directory to avoid conflicts
|
||||
|
Loading…
Reference in New Issue
Block a user