buglwIP - A Lightweight TCP/IP stack - Bugs: bug #58553, Memory disclosure for icmp6 in git...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #58553: Memory disclosure for icmp6 in git master branch

Submitter:  Wenqiang Li <silentdawn>
Submitted:  Fri 12 Jun 2020 05:22:10 PM UTC
   
 
Category:  Security-related Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  yarrick
Open/Closed:  Closed Planned Release:  None
lwIP version:  git head

Tue 23 Jun 2020 11:11:28 PM UTC, comment #3: 
Erik Ekman <yarrick>
Group Member
Tue 23 Jun 2020 11:05:55 PM UTC, comment #2: 
Erik Ekman <yarrick>
Group Member
Mon 22 Jun 2020 10:19:17 AM UTC, comment #1: 

I have reproduced this in a unit test and will try fixing it.

Erik Ekman <yarrick>
Group Member
Fri 12 Jun 2020 05:22:10 PM UTC, original submission:  

Type:
Buffer overflow

Description:
his bug is related to bug #58552. We have observed the changes made to the same place in the master branch. However, the bug still exists. The function pbuf_take_at() replaces the function SMEMCPY() in the master branch. However, it is still vulnerable.
The function pbuf_take_at() tries to copy fields from the original packet as shown in line 409 of icmp6.c. The parameter len of the function pbuf_take_at() is the length of another parameter dataptr. However, the function icmp6_send_response_with_addrs_and_netif() passes the parameters p->payload and p->tot_len to the function pbuf_take_at(), which are the total length of the p->payload plus all payloads length of its following pbuf . If p->tot_len is larger than the length of p->payload, the memory will leak to remote attackers through the network. To fix this, the datalen should be p->len, not p->tot_len.


385
static void icmp6_send_response_with_addrs_and_netif(struct pbuf *p, u8_t code, u32_t data, u8_t type, const ip6_addr_t *reply_src, const ip6_addr_t *reply_dest, struct netif *netif)
387
{

...
409
pbuf_take_at(q, p->payload, datalen, sizeof(struct icmp6_hdr));

...
423
}

Result:
Memory disclosure.

Wenqiang Li <silentdawn>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by yarrick (Posted a comment)
  • -email is unavailable- added by silentdawn (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-06-23 yarrick StatusNone Fixed
        Assigned toNone yarrick
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code