buglwIP - A Lightweight TCP/IP stack - Bugs: bug #50231, nd6: several option size related...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #50231: nd6: several option size related issues in Router Advertisement message processing

Submitter:  David van Moolenbroek <dcvmoole>
Submitted:  Sun 05 Feb 2017 01:20:20 PM UTC
   
 
Category:  IPv6 Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  git head

Fri 17 Feb 2017 09:27:36 PM UTC, comment #1: 
Simon Goldschmidt <goldsimon>
Group administrator
Sun 05 Feb 2017 01:20:20 PM UTC, original submission:  

The ND6 code that processes ICMP6_TYPE_RA messages has several problems, some with a high potential of making lwIP access buffers beyond their end:

1) nd6_ra_buffer is declared with size sizeof(prefix_option) whereas since the addition of RNDSS support, prefix_option may no longer be the largest option;
2) the RA processing's pbuf_copy_partial() call uses sizeof(prefix_option) rather than sizeof(nd6_ra_buffer), introducing additional risks of size mismatches even if point #1 is fixed;
3) the RA processing's pbuf_copy_partial() should not fail in that case that the last option is not as large as the largest option;
4) if the next option is contained within the first pbuf (ie the non-pbuf_copy_partial case), the location of buffer[1] may still be beyond the packet end;
5) there is no check to see whether the option's size in the packet (i.e., the value of buffer[1]) is fully contained within the buffer; note that this can only be done after checking #4;
6) none of the individual options have proper checks to see if the option's structure size matches the option's size in the packet before accessing structure fields; note that this check is not a replacement for #5.

(I apologize for not being able to afford the time to work on a patch for this myself, but in my implementation I have other reasons to patch out RA message processing altogether anyway..)

David van Moolenbroek <dcvmoole>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by dcvmoole (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-02-17 goldsimon StatusNone Fixed
        Assigned toNone goldsimon
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code