Skip to content
Permalink
Browse files

CVE-2017-13025/IPv6 mobility: Add a bounds check before fetching data

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't cause 'tcpdump: pcap_loop: truncated dump file'
  • Loading branch information...
fxlb authored and infrastation committed Mar 22, 2017
1 parent 7d3aba9 commit 5338aac7b8b880b0c5e0c15e27dadc44c5559284
Showing with 7 additions and 0 deletions.
  1. +3 −0 extract.h
  2. +1 −0 print-mobility.c
  3. +1 −0 tests/TESTLIST
  4. +2 −0 tests/mobility_opt_asan_3.out
  5. BIN tests/mobility_opt_asan_3.pcap
@@ -281,3 +281,6 @@ EXTRACT_64BITS(const void *p)

#define ND_TTEST_64BITS(p) ND_TTEST2(*(p), 8)
#define ND_TCHECK_64BITS(p) ND_TCHECK2(*(p), 8)

#define ND_TTEST_128BITS(p) ND_TTEST2(*(p), 16)
#define ND_TCHECK_128BITS(p) ND_TCHECK2(*(p), 16)
@@ -159,6 +159,7 @@ mobility_opt_print(netdissect_options *ndo,
ND_PRINT((ndo, "(altcoa: trunc)"));
goto trunc;
}
ND_TCHECK_128BITS(&bp[i+2]);
ND_PRINT((ndo, "(alt-CoA: %s)", ip6addr_string(ndo, &bp[i+2])));
break;
case IP6MOPT_NONCEID:
@@ -526,6 +526,7 @@ icmp6_mobileprefix_asan icmp6_mobileprefix_asan.pcap icmp6_mobileprefix_asan.out
ip_printroute_asan ip_printroute_asan.pcap ip_printroute_asan.out -v
mobility_opt_asan mobility_opt_asan.pcap mobility_opt_asan.out -v
mobility_opt_asan_2 mobility_opt_asan_2.pcap mobility_opt_asan_2.out -v
mobility_opt_asan_3 mobility_opt_asan_3.pcap mobility_opt_asan_3.out -v

# RTP tests
# fuzzed pcap
@@ -0,0 +1,2 @@
IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62) payload length: 7168) d400:7fa1:200:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: CoT nonce id=0x74 Care-of Init Cookie=80570f80:00000004[|MOBILITY]
IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62) payload length: 7168) ffc3:b2a1:200:400::6238:2949 > 9675:86dd:73f0:2c:1c7f:ffff:ebc3:b2a1: mobility: BU seq#=39837 lifetime=261452[|MOBILITY]
Binary file not shown.

0 comments on commit 5338aac

Please sign in to comment.
You can’t perform that action at this time.