rpms/libndp
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Validate route information option length

Browse Source 
Resolves: RHEL-45275

Signed-off-by: Felix Maurer <fmaurer@redhat.com>
This commit is contained in:
Felix Maurer 2024-06-25 12:01:36 +02:00
parent d15dc57cfd
commit 446da5bb5b
2 changed files with 50 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
0008-libndp-valid-route-information-option-length.patch Normal file
View File

@ -0,0 +1,44 @@
From 05e4ba7b0d126eea4c04387dcf40596059ee24af Mon Sep 17 00:00:00 2001
From: Hangbin Liu <liuhangbin@gmail.com>
Date: Wed, 5 Jun 2024 11:57:43 +0800
Subject: [PATCH] libndp: valid route information option length
RFC 4191 specifies that the Route Information Option Length should be 1, 2,
or 3, depending on the Prefix Length. A malicious node could potentially
trigger a buffer overflow and crash the tool by sending an IPv6 router
advertisement message containing the "Route Information" option with a
"Length" field larger than 3.
To address this, add a check on the length field.
Fixes: 8296a5bf0755 ("add support for Route Information Option (rfc4191)")
Reported-by: Evgeny Vereshchagin <evverx@gmail.com>
Suggested-by: Felix Maurer <fmaurer@redhat.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
libndp/libndp.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/libndp/libndp.c b/libndp/libndp.c
index 6314717..72ec92e 100644
--- a/libndp/libndp.c
+++ b/libndp/libndp.c
@@ -1231,6 +1231,17 @@ static bool ndp_msg_opt_route_check_valid(void *opt_data)
*/
if (((ri->nd_opt_ri_prf_reserved >> 3) & 3) == 2)
return false;
+
+ /* The Length field is 1, 2, or 3 depending on the Prefix Length.
+ * If Prefix Length is greater than 64, then Length must be 3.
+ * If Prefix Length is greater than 0, then Length must be 2 or 3.
+ * If Prefix Length is zero, then Length must be 1, 2, or 3.
+ */
+ if (ri->nd_opt_ri_len > 3 ||
+ (ri->nd_opt_ri_prefix_len > 64 && ri->nd_opt_ri_len != 3) ||
+ (ri->nd_opt_ri_prefix_len > 0 && ri->nd_opt_ri_len == 1))
+ return false;
+
return true;
}

7
libndp.spec
View File

@ -1,6 +1,6 @@
Name: libndp
Version: 1.7
Release: 6%{?dist}
Release: 7%{?dist}
Summary: Library for Neighbor Discovery Protocol
Group: System Environment/Libraries
License: LGPLv2+
@ -14,6 +14,7 @@ Patch4: 0004-libndp-fix-nd_msg-typo-when-setting-target-address.patch
Patch5: 0005-ndptool-add-D-dest-support.patch
Patch6: 0006-ndptool-fix-potential-memory-leak-caused-by-strdup.patch
Patch7: 0007-libndp-ndptool-use-poll-instead-of-select.patch
Patch8: 0008-libndp-valid-route-information-option-length.patch
%description
This package contains a library which provides a wrapper
@ -38,6 +39,7 @@ necessary for developing programs using libndp.
%patch5 -p1 -b .ndptool_add_D_dest_support
%patch6 -p1 -b .ndptool_fix_potential_memory_leak
%patch7 -p1 -b .ndptool_use_poll
%patch8 -p1 -b .libndp_route_info_length
%build
%configure --disable-static
@ -63,6 +65,9 @@ find $RPM_BUILD_ROOT -name \*.la -delete
%{_libdir}/pkgconfig/*.pc
%changelog
* Wed Jul 10 2024 Felix Maurer <fmaurer@redhat.com> - 1.7-7
- Validate route information option length
* Mon Apr 26 2021 Hangbin Liu <haliu@redhat.com> - 1.7-6
- Bump the version number due to conflict with (rhbz 1937721)