|
 |
b75bf67 |
From 897c113fda0886a28a986cc6ba17bb93bd6cb1c7 Mon Sep 17 00:00:00 2001
|
|
|
b75bf67 |
From: Simon Kelley <simon@thekelleys.org.uk>
|
|
|
b75bf67 |
Date: Mon, 25 Sep 2017 20:11:58 +0100
|
|
|
b75bf67 |
Subject: [PATCH 6/9] Security fix, CVE-2017-14496, Integer underflow in DNS
|
|
|
b75bf67 |
response creation.
|
|
|
b75bf67 |
|
|
|
b75bf67 |
Fix DoS in DNS. Invalid boundary checks in the
|
|
|
b75bf67 |
add_pseudoheader function allows a memcpy call with negative
|
|
|
b75bf67 |
size An attacker which can send malicious DNS queries
|
|
|
b75bf67 |
to dnsmasq can trigger a DoS remotely.
|
|
|
b75bf67 |
dnsmasq is vulnerable only if one of the following option is
|
|
|
b75bf67 |
specified: --add-mac, --add-cpe-id or --add-subnet.
|
|
|
b75bf67 |
---
|
|
|
b75bf67 |
src/edns0.c | 13 ++++++++++++-
|
|
|
b75bf67 |
1 file changed, 12 insertions(+), 1 deletion(-)
|
|
|
b75bf67 |
|
|
|
b75bf67 |
diff --git a/src/edns0.c b/src/edns0.c
|
|
|
b75bf67 |
index f5b798c..95b74ee 100644
|
|
|
b75bf67 |
--- a/src/edns0.c
|
|
|
b75bf67 |
+++ b/src/edns0.c
|
|
|
b75bf67 |
@@ -144,7 +144,7 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
|
|
|
b75bf67 |
GETSHORT(len, p);
|
|
|
b75bf67 |
|
|
|
b75bf67 |
/* malformed option, delete the whole OPT RR and start again. */
|
|
|
b75bf67 |
- if (i + len > rdlen)
|
|
|
b75bf67 |
+ if (i + 4 + len > rdlen)
|
|
|
b75bf67 |
{
|
|
|
b75bf67 |
rdlen = 0;
|
|
|
b75bf67 |
is_last = 0;
|
|
|
b75bf67 |
@@ -193,6 +193,8 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
|
|
|
b75bf67 |
ntohs(header->ancount) + ntohs(header->nscount) + ntohs(header->arcount),
|
|
|
b75bf67 |
header, plen)))
|
|
|
b75bf67 |
return plen;
|
|
|
b75bf67 |
+ if (p + 11 > limit)
|
|
|
b75bf67 |
+ return plen; /* Too big */
|
|
|
b75bf67 |
*p++ = 0; /* empty name */
|
|
|
b75bf67 |
PUTSHORT(T_OPT, p);
|
|
|
b75bf67 |
PUTSHORT(udp_sz, p); /* max packet length, 512 if not given in EDNS0 header */
|
|
|
b75bf67 |
@@ -204,6 +206,11 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
|
|
|
b75bf67 |
/* Copy back any options */
|
|
|
b75bf67 |
if (buff)
|
|
|
b75bf67 |
{
|
|
|
b75bf67 |
+ if (p + rdlen > limit)
|
|
|
b75bf67 |
+ {
|
|
|
b75bf67 |
+ free(buff);
|
|
|
b75bf67 |
+ return plen; /* Too big */
|
|
|
b75bf67 |
+ }
|
|
|
b75bf67 |
memcpy(p, buff, rdlen);
|
|
|
b75bf67 |
free(buff);
|
|
|
b75bf67 |
p += rdlen;
|
|
|
b75bf67 |
@@ -220,8 +227,12 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
|
|
|
b75bf67 |
/* Add new option */
|
|
|
b75bf67 |
if (optno != 0 && replace != 2)
|
|
|
b75bf67 |
{
|
|
|
b75bf67 |
+ if (p + 4 > limit)
|
|
|
b75bf67 |
+ return plen; /* Too big */
|
|
|
b75bf67 |
PUTSHORT(optno, p);
|
|
|
b75bf67 |
PUTSHORT(optlen, p);
|
|
|
b75bf67 |
+ if (p + optlen > limit)
|
|
|
b75bf67 |
+ return plen; /* Too big */
|
|
|
b75bf67 |
memcpy(p, opt, optlen);
|
|
|
b75bf67 |
p += optlen;
|
|
|
b75bf67 |
PUTSHORT(p - datap, lenp);
|
|
|
b75bf67 |
--
|
|
|
b75bf67 |
2.9.5
|
|
|
b75bf67 |
|