buglwIP - A Lightweight TCP/IP stack - Bugs: bug #53696, Bug in MTU value validation ...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #53696: Bug in MTU value validation (case: ND6_OPTION_TYPE_MTU)

Submitter:  Arkadiusz Wróbel <catsuryuu>
Submitted:  Thu 19 Apr 2018 02:02:28 AM UTC
   
 
Category:  Security-related Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  2.1.0
lwIP version:  git head

Thu 14 Jun 2018 10:56:08 AM UTC, comment #2: 
Simon Goldschmidt <goldsimon>
Group administrator
Thu 19 Apr 2018 06:31:39 AM UTC, comment #1: 

I see additional problems here:
- I don't think that IPv6 RA messages should interfere with the MTU used for IPv4
- I think we should somehow check that this MTU does not get larger than the netif supports

In other words, we should probably store the MTU received through RA at a different place and use the minimum of this and netif->mtu when calculating packet sizes.

Simon Goldschmidt <goldsimon>
Group administrator
Thu 19 Apr 2018 02:02:28 AM UTC, original submission:  

The problem occurs when mtu_opt->mtu is greater than 2^16.
Then 'lwip_htonl(mtu_opt->mtu) >= 1280' will give TRUE, but the value is later casted to u16_t.

For example, for mtu_opt->mtu == 2^16 + 1 the inp->mtu value will be set to 1 and the server will start sending invalid IPv4 packets only.

What's more, an external host can set the MTU to 20.
Then, if an Echo Request (IPv4) comes, the server will fall into an infinite loop, flooding the sender with empty IPv4 packets.

I think doing the validation AFTER casting to u16_t should do the job.
[Related with: nd6.c:690]

Arkadiusz Wróbel <catsuryuu>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #43971:  set_mtu_to_1.bin added by catsuryuu (78B - application/octet-stream - These are raw bytes dumps.)
file #43972:  set_mtu_to_20.bin added by catsuryuu (78B - application/octet-stream - These are raw bytes dumps.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by catsuryuu (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-06-14 goldsimon StatusNone Fixed
        Assigned toNone goldsimon
        Open/ClosedOpen Closed
    2018-06-13 goldsimon Planned ReleaseNone 2.1.0
    2018-04-19 catsuryuu Attached File- Added set_mtu_to_1.bin, #43971
        Attached File- Added set_mtu_to_20.bin, #43972

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code