Skip to content

Commit 5338aac

Browse files
fxlbinfrastation
authored andcommitted
CVE-2017-13025/IPv6 mobility: Add a bounds check before fetching data
This fixes a buffer over-read discovered by Bhargava Shastry, SecT/TU Berlin. Add a test using the capture file supplied by the reporter(s), modified so the capture file won't cause 'tcpdump: pcap_loop: truncated dump file'
1 parent 7d3aba9 commit 5338aac

File tree

5 files changed

+7
-0
lines changed

5 files changed

+7
-0
lines changed

Diff for: extract.h

+3
Original file line numberDiff line numberDiff line change
@@ -281,3 +281,6 @@ EXTRACT_64BITS(const void *p)
281281

282282
#define ND_TTEST_64BITS(p) ND_TTEST2(*(p), 8)
283283
#define ND_TCHECK_64BITS(p) ND_TCHECK2(*(p), 8)
284+
285+
#define ND_TTEST_128BITS(p) ND_TTEST2(*(p), 16)
286+
#define ND_TCHECK_128BITS(p) ND_TCHECK2(*(p), 16)

Diff for: print-mobility.c

+1
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,7 @@ mobility_opt_print(netdissect_options *ndo,
159159
ND_PRINT((ndo, "(altcoa: trunc)"));
160160
goto trunc;
161161
}
162+
ND_TCHECK_128BITS(&bp[i+2]);
162163
ND_PRINT((ndo, "(alt-CoA: %s)", ip6addr_string(ndo, &bp[i+2])));
163164
break;
164165
case IP6MOPT_NONCEID:

Diff for: tests/TESTLIST

+1
Original file line numberDiff line numberDiff line change
@@ -526,6 +526,7 @@ icmp6_mobileprefix_asan icmp6_mobileprefix_asan.pcap icmp6_mobileprefix_asan.out
526526
ip_printroute_asan ip_printroute_asan.pcap ip_printroute_asan.out -v
527527
mobility_opt_asan mobility_opt_asan.pcap mobility_opt_asan.out -v
528528
mobility_opt_asan_2 mobility_opt_asan_2.pcap mobility_opt_asan_2.out -v
529+
mobility_opt_asan_3 mobility_opt_asan_3.pcap mobility_opt_asan_3.out -v
529530

530531
# RTP tests
531532
# fuzzed pcap

Diff for: tests/mobility_opt_asan_3.out

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62) payload length: 7168) d400:7fa1:200:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: CoT nonce id=0x74 Care-of Init Cookie=80570f80:00000004[|MOBILITY]
2+
IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62) payload length: 7168) ffc3:b2a1:200:400::6238:2949 > 9675:86dd:73f0:2c:1c7f:ffff:ebc3:b2a1: mobility: BU seq#=39837 lifetime=261452[|MOBILITY]

Diff for: tests/mobility_opt_asan_3.pcap

256 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)