You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
67 lines
2.3 KiB
67 lines
2.3 KiB
7 years ago
|
From 5ab67e936085a9e584c9b3e43f442ef5bee7f40e Mon Sep 17 00:00:00 2001
|
||
|
|
From: Simon Kelley <simon@thekelleys.org.uk>
|
||
|
|
Date: Mon, 25 Sep 2017 20:11:58 +0100
|
||
|
|
Subject: [PATCH 5/9] Security fix, CVE-2017-14496, Integer underflow in
|
||
|
|
DNS response creation.
|
||
|
|
|
||
|
|
Fix DoS in DNS. Invalid boundary checks in the
|
||
|
|
add_pseudoheader function allows a memcpy call with negative
|
||
|
|
size An attacker which can send malicious DNS queries
|
||
|
|
to dnsmasq can trigger a DoS remotely.
|
||
|
|
dnsmasq is vulnerable only if one of the following option is
|
||
|
|
specified: --add-mac, --add-cpe-id or --add-subnet.
|
||
|
|
---
|
||
|
|
src/edns0.c | 13 ++++++++++++-
|
||
|
|
1 file changed, 12 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/src/edns0.c b/src/edns0.c
|
||
|
|
index d2b514b..eed135e 100644
|
||
|
|
--- a/src/edns0.c
|
||
|
|
+++ b/src/edns0.c
|
||
|
|
@@ -144,7 +144,7 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
|
||
|
|
GETSHORT(len, p);
|
||
|
|
|
||
|
|
/* malformed option, delete the whole OPT RR and start again. */
|
||
|
|
- if (i + len > rdlen)
|
||
|
|
+ if (i + 4 + len > rdlen)
|
||
|
|
{
|
||
|
|
rdlen = 0;
|
||
|
|
is_last = 0;
|
||
|
|
@@ -193,6 +193,8 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
|
||
|
|
ntohs(header->ancount) + ntohs(header->nscount) + ntohs(header->arcount),
|
||
|
|
header, plen)))
|
||
|
|
return plen;
|
||
|
|
+ if (p + 11 > limit)
|
||
|
|
+ return plen; /* Too big */
|
||
|
|
*p++ = 0; /* empty name */
|
||
|
|
PUTSHORT(T_OPT, p);
|
||
|
|
PUTSHORT(udp_sz, p); /* max packet length, 512 if not given in EDNS0 header */
|
||
|
|
@@ -204,6 +206,11 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
|
||
|
|
/* Copy back any options */
|
||
|
|
if (buff)
|
||
|
|
{
|
||
|
|
+ if (p + rdlen > limit)
|
||
|
|
+ {
|
||
|
|
+ free(buff);
|
||
|
|
+ return plen; /* Too big */
|
||
|
|
+ }
|
||
|
|
memcpy(p, buff, rdlen);
|
||
|
|
free(buff);
|
||
|
|
p += rdlen;
|
||
|
|
@@ -217,8 +224,12 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
|
||
|
|
/* Add new option */
|
||
|
|
if (optno != 0 && replace != 2)
|
||
|
|
{
|
||
|
|
+ if (p + 4 > limit)
|
||
|
|
+ return plen; /* Too big */
|
||
|
|
PUTSHORT(optno, p);
|
||
|
|
PUTSHORT(optlen, p);
|
||
|
|
+ if (p + optlen > limit)
|
||
|
|
+ return plen; /* Too big */
|
||
|
|
memcpy(p, opt, optlen);
|
||
|
|
p += optlen;
|
||
|
|
PUTSHORT(p - datap, lenp);
|
||
|
|
--
|
||
|
|
2.9.5
|
||
|
|
|