buglwIP - A Lightweight TCP/IP stack - Bugs: bug #53696, Bug in MTU value validation ...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #53696: Bug in MTU value validation (case: ND6_OPTION_TYPE_MTU)

Submitted by:  Arkadiusz Wróbel <catsuryuu>
Submitted on:  Thu 19 Apr 2018 02:02:28 AM UTC  
 
Category:  Security-related Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  Simon Goldschmidt <goldsimon>
Open/Closed:  Closed Planned Release:  2.1.0
lwIP version:  git head

Thu 14 Jun 2018 10:56:08 AM UTC, comment #2: 
Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Thu 19 Apr 2018 06:31:39 AM UTC, comment #1: 

I see additional problems here:
- I don't think that IPv6 RA messages should interfere with the MTU used for IPv4
- I think we should somehow check that this MTU does not get larger than the netif supports

In other words, we should probably store the MTU received through RA at a different place and use the minimum of this and netif->mtu when calculating packet sizes.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Thu 19 Apr 2018 02:02:28 AM UTC, original submission:  

The problem occurs when mtu_opt->mtu is greater than 2^16.
Then 'lwip_htonl(mtu_opt->mtu) >= 1280' will give TRUE, but the value is later casted to u16_t.

For example, for mtu_opt->mtu == 2^16 + 1 the inp->mtu value will be set to 1 and the server will start sending invalid IPv4 packets only.

What's more, an external host can set the MTU to 20.
Then, if an Echo Request (IPv4) comes, the server will fall into an infinite loop, flooding the sender with empty IPv4 packets.

I think doing the validation AFTER casting to u16_t should do the job.
[Related with: nd6.c:690]

Arkadiusz Wróbel <catsuryuu>

 

Attached Files
file #43971:  set_mtu_to_1.bin added by catsuryuu (78B - application/octet-stream - These are raw bytes dumps.)
file #43972:  set_mtu_to_20.bin added by catsuryuu (78B - application/octet-stream - These are raw bytes dumps.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by catsuryuu (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-06-14 goldsimon StatusNone => Fixed
        Assigned toNone => goldsimon
        Open/ClosedOpen => Closed
    2018-06-13 goldsimon Planned ReleaseNone => 2.1.0
    2018-04-19 catsuryuu Attached File- => Added set_mtu_to_1.bin, #43971
        Attached File- => Added set_mtu_to_20.bin, #43972

    Back to the top


    Powered by Savane 3.5