buglwIP - A Lightweight TCP/IP stack - Bugs: bug #53705, Buffer overflow in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #53705: Buffer overflow in low_level_output in tapif.c (port for Unix)

Submitter:  Arkadiusz Wróbel <catsuryuu>
Submitted:  Fri 20 Apr 2018 03:29:55 AM UTC
   
 
Category:  Security-related Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Planned Release:  None
lwIP version:  git head

Fri 20 Apr 2018 02:58:05 PM UTC, comment #2: 


> Could you please tell me how to reproduce ...

You have to send a big Echo Request for ICMPv6 :)

I worked on 'echop' (compiled with LWIP_IPV6 and IPV6_FRAG_COPYHEADER). I left LWIP_IPV6_FRAG disabled.

I wanted to just use:
ping6 -I tap0 fe80::12:34ff:fe56:78ab -s 2000
but I have a problem with Neighbor Solicitation on tap0.
Should the server (echop) ask about ff02::1:ff40:5060 ?
I think it should be just ff02::1 (then everything works).
If I'm right I can make another submit with more details.

Anyway, I also attached a pcap file with my bug report.
There are three packets inside:
- two fragments of Echo Request for ICMPv6
- Neighbor Advertisement for the fake host (10:20:30:40:50:60)
I triggered the bug with them.

Arkadiusz Wróbel <catsuryuu>
Fri 20 Apr 2018 07:15:12 AM UTC, comment #1: 

Fixed, thanks for reporting.

Could you please tell me how to reproduce the "too big Echo Reply for ICMPv6" because this sounds like another bug...

Dirk Ziegelmeier <dziegel>
Group administrator
Fri 20 Apr 2018 03:29:55 AM UTC, original submission:  

'pbuf_copy_partial' should copy at most sizeof(buf) bytes.
Similarly with the following 'write'.

The bug is triggered when the server is trying to send too big Echo Reply for ICMPv6.

[Related with: lwip-contrib/ports/unix/port/netif/tapif.c:237]

Arkadiusz Wróbel <catsuryuu>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #43980:  ping6_2000.pcap added by catsuryuu (2KiB - application/vnd.tcpdump.pcap - Sending these three packets should trigger the bug (for 'echop' compiled with IPv6))

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Updated the item)
  • -email is unavailable- added by dziegel (Posted a comment)
  • -email is unavailable- added by catsuryuu (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-04-25 goldsimon Open/ClosedOpen Closed
    2018-04-22 dziegel StatusReady For Test Fixed
    2018-04-20 dziegel StatusNone Ready For Test
    2018-04-20 catsuryuu Attached File- Added ping6_2000.pcap, #43980

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code