buglwIP - A Lightweight TCP/IP stack - Bugs: bug #50231, nd6: several option size related...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #50231: nd6: several option size related issues in Router Advertisement message processing

Submitted by:  David van Moolenbroek <dcvmoole>
Submitted on:  Sun 05 Feb 2017 01:20:20 PM UTC  
 
Category: IPv6Severity: 3 - Normal
Item Group: Faulty BehaviourStatus: Fixed
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: git head

Fri 17 Feb 2017 09:27:36 PM UTC, comment #1:

This should hopefully be fixed now, thanks for reporting.

http://git.savannah.gnu.org/cgit/lwip.git/commit/?id=ff3fe1f489e51c293b29b6400139aac3f2b1c8a2

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Sun 05 Feb 2017 01:20:20 PM UTC, original submission:

The ND6 code that processes ICMP6_TYPE_RA messages has several problems, some with a high potential of making lwIP access buffers beyond their end:

1) nd6_ra_buffer is declared with size sizeof(prefix_option) whereas since the addition of RNDSS support, prefix_option may no longer be the largest option;
2) the RA processing's pbuf_copy_partial() call uses sizeof(prefix_option) rather than sizeof(nd6_ra_buffer), introducing additional risks of size mismatches even if point #1 is fixed;
3) the RA processing's pbuf_copy_partial() should not fail in that case that the last option is not as large as the largest option;
4) if the next option is contained within the first pbuf (ie the non-pbuf_copy_partial case), the location of buffer[1] may still be beyond the packet end;
5) there is no check to see whether the option's size in the packet (i.e., the value of buffer[1]) is fully contained within the buffer; note that this can only be done after checking #4;
6) none of the individual options have proper checks to see if the option's structure size matches the option's size in the packet before accessing structure fields; note that this check is not a replacement for #5.

(I apologize for not being able to afford the time to work on a patch for this myself, but in my implementation I have other reasons to patch out RA message processing altogether anyway..)

David van Moolenbroek <dcvmoole>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by dcvmoole (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 17 Feb 2017 09:27:36 PM UTCgoldsimonStatusNone=>Fixed
      Assigned toNone=>goldsimon
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1