mirror of
git://git.openembedded.org/meta-openembedded
synced 2026-04-02 02:49:12 +00:00
dnsmasq: CVE-2022-0934 Heap use after free in dhcp6_no_relay
Source: https://thekelleys.org.uk/gitweb/?p=dnsmasq.git MR: 121726 Type: Security Fix Disposition: Backport from https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=03345ecefeb0d82e3c3a4c28f27c3554f0611b39 ChangeID: be554ef6ebedd7148404ea3cc280f2e42e17dc8c Description: CVE-2022-0934 dnsmasq: Heap use after free in dhcp6_no_relay. Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
This commit is contained in:
Hitendra Prajapati
Armin Kuster
parent
62842aac98
commit
8377de1624
@ -0,0 +1,188 @@
|
||||
From 70df9f9104c8f0661966298b58caf794b99e26e1 Mon Sep 17 00:00:00 2001
|
||||
From: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
Date: Thu, 22 Sep 2022 17:39:21 +0530
|
||||
Subject: [PATCH] CVE-2022-0934
|
||||
|
||||
Upstream-Status: Backport [https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=03345ecefeb0d82e3c3a4c28f27c3554f0611b39]
|
||||
CVE: CVE-2022-0934
|
||||
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
---
|
||||
CHANGELOG | 2 ++
|
||||
src/rfc3315.c | 48 +++++++++++++++++++++++++++---------------------
|
||||
2 files changed, 29 insertions(+), 21 deletions(-)
|
||||
|
||||
diff --git a/CHANGELOG b/CHANGELOG
|
||||
index 60b08d0..d1d7e41 100644
|
||||
--- a/CHANGELOG
|
||||
+++ b/CHANGELOG
|
||||
@@ -88,6 +88,8 @@ version 2.81
|
||||
|
||||
Add --script-on-renewal option.
|
||||
|
||||
+ Fix write-after-free error in DHCPv6 server code.
|
||||
+ CVE-2022-0934 refers.
|
||||
|
||||
version 2.80
|
||||
Add support for RFC 4039 DHCP rapid commit. Thanks to Ashram Method
|
||||
diff --git a/src/rfc3315.c b/src/rfc3315.c
|
||||
index b3f0a0a..eef1360 100644
|
||||
--- a/src/rfc3315.c
|
||||
+++ b/src/rfc3315.c
|
||||
@@ -33,9 +33,9 @@ struct state {
|
||||
unsigned int mac_len, mac_type;
|
||||
};
|
||||
|
||||
-static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,
|
||||
+static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz,
|
||||
struct in6_addr *client_addr, int is_unicast, time_t now);
|
||||
-static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now);
|
||||
+static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now);
|
||||
static void log6_opts(int nest, unsigned int xid, void *start_opts, void *end_opts);
|
||||
static void log6_packet(struct state *state, char *type, struct in6_addr *addr, char *string);
|
||||
static void log6_quiet(struct state *state, char *type, struct in6_addr *addr, char *string);
|
||||
@@ -104,12 +104,12 @@ unsigned short dhcp6_reply(struct dhcp_context *context, int interface, char *if
|
||||
}
|
||||
|
||||
/* This cost me blood to write, it will probably cost you blood to understand - srk. */
|
||||
-static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,
|
||||
+static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz,
|
||||
struct in6_addr *client_addr, int is_unicast, time_t now)
|
||||
{
|
||||
void *end = inbuff + sz;
|
||||
void *opts = inbuff + 34;
|
||||
- int msg_type = *((unsigned char *)inbuff);
|
||||
+ int msg_type = *inbuff;
|
||||
unsigned char *outmsgtypep;
|
||||
void *opt;
|
||||
struct dhcp_vendor *vendor;
|
||||
@@ -259,15 +259,15 @@ static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,
|
||||
return 1;
|
||||
}
|
||||
|
||||
-static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now)
|
||||
+static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now)
|
||||
{
|
||||
void *opt;
|
||||
- int i, o, o1, start_opts;
|
||||
+ int i, o, o1, start_opts, start_msg;
|
||||
struct dhcp_opt *opt_cfg;
|
||||
struct dhcp_netid *tagif;
|
||||
struct dhcp_config *config = NULL;
|
||||
struct dhcp_netid known_id, iface_id, v6_id;
|
||||
- unsigned char *outmsgtypep;
|
||||
+ unsigned char outmsgtype;
|
||||
struct dhcp_vendor *vendor;
|
||||
struct dhcp_context *context_tmp;
|
||||
struct dhcp_mac *mac_opt;
|
||||
@@ -296,12 +296,13 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
|
||||
v6_id.next = state->tags;
|
||||
state->tags = &v6_id;
|
||||
|
||||
- /* copy over transaction-id, and save pointer to message type */
|
||||
- if (!(outmsgtypep = put_opt6(inbuff, 4)))
|
||||
+ start_msg = save_counter(-1);
|
||||
+ /* copy over transaction-id */
|
||||
+ if (!put_opt6(inbuff, 4))
|
||||
return 0;
|
||||
start_opts = save_counter(-1);
|
||||
- state->xid = outmsgtypep[3] | outmsgtypep[2] << 8 | outmsgtypep[1] << 16;
|
||||
-
|
||||
+ state->xid = inbuff[3] | inbuff[2] << 8 | inbuff[1] << 16;
|
||||
+
|
||||
/* We're going to be linking tags from all context we use.
|
||||
mark them as unused so we don't link one twice and break the list */
|
||||
for (context_tmp = state->context; context_tmp; context_tmp = context_tmp->current)
|
||||
@@ -347,7 +348,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
|
||||
(msg_type == DHCP6REQUEST || msg_type == DHCP6RENEW || msg_type == DHCP6RELEASE || msg_type == DHCP6DECLINE))
|
||||
|
||||
{
|
||||
- *outmsgtypep = DHCP6REPLY;
|
||||
+ outmsgtype = DHCP6REPLY;
|
||||
o1 = new_opt6(OPTION6_STATUS_CODE);
|
||||
put_opt6_short(DHCP6USEMULTI);
|
||||
put_opt6_string("Use multicast");
|
||||
@@ -619,11 +620,11 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
|
||||
struct dhcp_netid *solicit_tags;
|
||||
struct dhcp_context *c;
|
||||
|
||||
- *outmsgtypep = DHCP6ADVERTISE;
|
||||
+ outmsgtype = DHCP6ADVERTISE;
|
||||
|
||||
if (opt6_find(state->packet_options, state->end, OPTION6_RAPID_COMMIT, 0))
|
||||
{
|
||||
- *outmsgtypep = DHCP6REPLY;
|
||||
+ outmsgtype = DHCP6REPLY;
|
||||
state->lease_allocate = 1;
|
||||
o = new_opt6(OPTION6_RAPID_COMMIT);
|
||||
end_opt6(o);
|
||||
@@ -809,7 +810,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
|
||||
int start = save_counter(-1);
|
||||
|
||||
/* set reply message type */
|
||||
- *outmsgtypep = DHCP6REPLY;
|
||||
+ outmsgtype = DHCP6REPLY;
|
||||
state->lease_allocate = 1;
|
||||
|
||||
log6_quiet(state, "DHCPREQUEST", NULL, ignore ? _("ignored") : NULL);
|
||||
@@ -921,7 +922,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
|
||||
case DHCP6RENEW:
|
||||
{
|
||||
/* set reply message type */
|
||||
- *outmsgtypep = DHCP6REPLY;
|
||||
+ outmsgtype = DHCP6REPLY;
|
||||
|
||||
log6_quiet(state, "DHCPRENEW", NULL, NULL);
|
||||
|
||||
@@ -1033,7 +1034,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
|
||||
int good_addr = 0;
|
||||
|
||||
/* set reply message type */
|
||||
- *outmsgtypep = DHCP6REPLY;
|
||||
+ outmsgtype = DHCP6REPLY;
|
||||
|
||||
log6_quiet(state, "DHCPCONFIRM", NULL, NULL);
|
||||
|
||||
@@ -1097,7 +1098,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
|
||||
log6_quiet(state, "DHCPINFORMATION-REQUEST", NULL, ignore ? _("ignored") : state->hostname);
|
||||
if (ignore)
|
||||
return 0;
|
||||
- *outmsgtypep = DHCP6REPLY;
|
||||
+ outmsgtype = DHCP6REPLY;
|
||||
tagif = add_options(state, 1);
|
||||
break;
|
||||
}
|
||||
@@ -1106,7 +1107,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
|
||||
case DHCP6RELEASE:
|
||||
{
|
||||
/* set reply message type */
|
||||
- *outmsgtypep = DHCP6REPLY;
|
||||
+ outmsgtype = DHCP6REPLY;
|
||||
|
||||
log6_quiet(state, "DHCPRELEASE", NULL, NULL);
|
||||
|
||||
@@ -1171,7 +1172,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
|
||||
case DHCP6DECLINE:
|
||||
{
|
||||
/* set reply message type */
|
||||
- *outmsgtypep = DHCP6REPLY;
|
||||
+ outmsgtype = DHCP6REPLY;
|
||||
|
||||
log6_quiet(state, "DHCPDECLINE", NULL, NULL);
|
||||
|
||||
@@ -1251,7 +1252,12 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
|
||||
}
|
||||
|
||||
}
|
||||
-
|
||||
+
|
||||
+ /* Fill in the message type. Note that we store the offset,
|
||||
+ not a direct pointer, since the packet memory may have been
|
||||
+ reallocated. */
|
||||
+ ((unsigned char *)(daemon->outpacket.iov_base))[start_msg] = outmsgtype;
|
||||
+
|
||||
log_tags(tagif, state->xid);
|
||||
log6_opts(0, state->xid, daemon->outpacket.iov_base + start_opts, daemon->outpacket.iov_base + save_counter(-1));
|
||||
|
||||
--
|
||||
2.25.1
|
||||
|
||||
@ -11,4 +11,5 @@ SRC_URI += "\
|
||||
file://CVE-2020-25686-1.patch \
|
||||
file://CVE-2020-25686-2.patch \
|
||||
file://CVE-2021-3448.patch \
|
||||
file://CVE-2022-0934.patch \
|
||||
"
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user