buglwIP - A Lightweight TCP/IP stack - Bugs: bug #58553, Memory disclosure for icmp6 in git...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #58553: Memory disclosure for icmp6 in git master branch

Submitted by:  Wenqiang Li <silentdawn>
Submitted on:  Fri 12 Jun 2020 05:22:10 PM UTC  
 
Category:  Security-related Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  Erik Ekman <yarrick>
Open/Closed:  Closed Planned Release:  None
lwIP version:  git head

Tue 23 Jun 2020 11:11:28 PM UTC, comment #3: 
Erik Ekman <yarrick>
Project MemberIn charge of this item.
Tue 23 Jun 2020 11:05:55 PM UTC, comment #2: 
Erik Ekman <yarrick>
Project MemberIn charge of this item.
Mon 22 Jun 2020 10:19:17 AM UTC, comment #1: 

I have reproduced this in a unit test and will try fixing it.

Erik Ekman <yarrick>
Project MemberIn charge of this item.
Fri 12 Jun 2020 05:22:10 PM UTC, original submission:  

Type:
Buffer overflow

Description:
his bug is related to bug #58552. We have observed the changes made to the same place in the master branch. However, the bug still exists. The function pbuf_take_at() replaces the function SMEMCPY() in the master branch. However, it is still vulnerable.
The function pbuf_take_at() tries to copy fields from the original packet as shown in line 409 of icmp6.c. The parameter len of the function pbuf_take_at() is the length of another parameter dataptr. However, the function icmp6_send_response_with_addrs_and_netif() passes the parameters p->payload and p->tot_len to the function pbuf_take_at(), which are the total length of the p->payload plus all payloads length of its following pbuf . If p->tot_len is larger than the length of p->payload, the memory will leak to remote attackers through the network. To fix this, the datalen should be p->len, not p->tot_len.

385
static void icmp6_send_response_with_addrs_and_netif(struct pbuf p, u8_t code, u32_t data, u8_t type, const ip6_addr_t reply_src, const ip6_addr_t reply_dest, struct netif netif)
387
{

...
409
pbuf_take_at(q, p->payload, datalen, sizeof(struct icmp6_hdr));

...
423
}

Result:
Memory disclosure.

Wenqiang Li <silentdawn>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by yarrick (Posted a comment)
  • -email is unavailable- added by silentdawn (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-06-23 yarrick StatusNone => Fixed
        Assigned toNone => yarrick
        Open/ClosedOpen => Closed

    Back to the top


    Powered by Savane 3.7