buglwIP - A Lightweight TCP/IP stack - Bugs: bug #58552, Memory disclosure for icmp6

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #58552: Memory disclosure for icmp6

Submitter:  Wenqiang Li <silentdawn>
Submitted:  Fri 12 Jun 2020 05:20:15 PM UTC
   
 
Category:  Security-related Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Planned Release:  None
lwIP version:  2.1.1

Sat 13 Nov 2021 12:56:01 PM UTC, comment #3: 

Fixed in 2.1.3

Erik Ekman <yarrick>
Group Member
Mon 22 Jun 2020 10:44:40 PM UTC, comment #2: 

comment #1:

> The code was changed while solving bug #56013:
> http://git.savannah.nongnu.org/cgit/lwip.git/commit/?id=d843e47a1d65451bd7f7aaa5017b408bd108be88
>
> Do you still think it can happen?
>


comment #1:

> The code was changed while solving bug #56013:
> http://git.savannah.nongnu.org/cgit/lwip.git/commit/?id=d843e47a1d65451bd7f7aaa5017b408bd108be88
>
> Do you still think it can happen?
>

Wenqiang Li <silentdawn>
Sun 21 Jun 2020 08:45:36 PM UTC, comment #1: 

The code was changed while solving bug #56013:
http://git.savannah.nongnu.org/cgit/lwip.git/commit/?id=d843e47a1d65451bd7f7aaa5017b408bd108be88

Do you still think it can happen?

Erik Ekman <yarrick>
Group Member
Fri 12 Jun 2020 05:20:15 PM UTC, original submission:  

This bug still exists in the latest version 2.1.2.

Type:
Buffer overflow

Description:
The function icmp6_send_response_with_addrs_and_netif() tries to parse an ICMPv6 packet and send it out. Inside it, the function SMEMCPY() as shown in line 408 of icmp6.c tries to copy a buffer pointed to by p->payload with length (IP6_HLEN + LWIP_ICMP6_DATASIZE). However, this buffer may be smaller than (IP6_HLEN + LWIP_ICMP6_DATASIZE). If this happens, it will cause a memory leakage. To fix this, the length should be compared with p->len.


385
static void icmp6_send_response_with_addrs_and_netif(struct pbuf *p, u8_t code, u32_t data, u8_t type, const ip6_addr_t *reply_src, const ip6_addr_t *reply_dest, struct netif *netif){

...
408
SMEMCPY((u8_t )q->payload + sizeof(struct icmp6_hdr), (u8_t )p->payload, IP6_HLEN + LWIP_ICMP6_DATASIZE);

..
423
}

Result:
Memory disclosure

Wenqiang Li <silentdawn>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by yarrick (Posted a comment)
  • -email is unavailable- added by silentdawn (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-11-13 yarrick StatusNone Fixed
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code