| From 3cdecc159e0f417a2f8d43d99632af26beea630f Mon Sep 17 00:00:00 2001 |
| From: Simon Kelley <simon@thekelleys.org.uk> |
| Date: Thu, 31 Mar 2022 21:35:20 +0100 |
| Subject: [PATCH] Fix write-after-free error in DHCPv6 code. CVE-2022-0934 |
| refers. |
| |
| CVE: CVE-2022-0934 |
| |
| Upstream-Status: Backport |
| [https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=03345ecefe] |
| |
| Signed-off-by: Yi Zhao <yi.zhao@windriver.com> |
| --- |
| CHANGELOG | 3 +++ |
| src/rfc3315.c | 48 +++++++++++++++++++++++++++--------------------- |
| 2 files changed, 30 insertions(+), 21 deletions(-) |
| |
| diff --git a/CHANGELOG b/CHANGELOG |
| index 5e54df9..a28da2a 100644 |
| --- a/CHANGELOG |
| +++ b/CHANGELOG |
| @@ -1,4 +1,7 @@ |
| version 2.86 |
| + Fix write-after-free error in DHCPv6 server code. |
| + CVE-2022-0934 refers. |
| + |
| Handle DHCPREBIND requests in the DHCPv6 server code. |
| Thanks to Aichun Li for spotting this omission, and the initial |
| patch. |
| diff --git a/src/rfc3315.c b/src/rfc3315.c |
| index 5c2ff97..6ecfeeb 100644 |
| --- a/src/rfc3315.c |
| +++ b/src/rfc3315.c |
| @@ -33,9 +33,9 @@ struct state { |
| unsigned int mac_len, mac_type; |
| }; |
| |
| -static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz, |
| +static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz, |
| struct in6_addr *client_addr, int is_unicast, time_t now); |
| -static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now); |
| +static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now); |
| static void log6_opts(int nest, unsigned int xid, void *start_opts, void *end_opts); |
| static void log6_packet(struct state *state, char *type, struct in6_addr *addr, char *string); |
| static void log6_quiet(struct state *state, char *type, struct in6_addr *addr, char *string); |
| @@ -104,12 +104,12 @@ unsigned short dhcp6_reply(struct dhcp_context *context, int interface, char *if |
| } |
| |
| /* This cost me blood to write, it will probably cost you blood to understand - srk. */ |
| -static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz, |
| +static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz, |
| struct in6_addr *client_addr, int is_unicast, time_t now) |
| { |
| void *end = inbuff + sz; |
| void *opts = inbuff + 34; |
| - int msg_type = *((unsigned char *)inbuff); |
| + int msg_type = *inbuff; |
| unsigned char *outmsgtypep; |
| void *opt; |
| struct dhcp_vendor *vendor; |
| @@ -259,15 +259,15 @@ static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz, |
| return 1; |
| } |
| |
| -static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now) |
| +static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now) |
| { |
| void *opt; |
| - int i, o, o1, start_opts; |
| + int i, o, o1, start_opts, start_msg; |
| struct dhcp_opt *opt_cfg; |
| struct dhcp_netid *tagif; |
| struct dhcp_config *config = NULL; |
| struct dhcp_netid known_id, iface_id, v6_id; |
| - unsigned char *outmsgtypep; |
| + unsigned char outmsgtype; |
| struct dhcp_vendor *vendor; |
| struct dhcp_context *context_tmp; |
| struct dhcp_mac *mac_opt; |
| @@ -296,12 +296,13 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_ |
| v6_id.next = state->tags; |
| state->tags = &v6_id; |
| |
| - /* copy over transaction-id, and save pointer to message type */ |
| - if (!(outmsgtypep = put_opt6(inbuff, 4))) |
| + start_msg = save_counter(-1); |
| + /* copy over transaction-id */ |
| + if (!put_opt6(inbuff, 4)) |
| return 0; |
| start_opts = save_counter(-1); |
| - state->xid = outmsgtypep[3] | outmsgtypep[2] << 8 | outmsgtypep[1] << 16; |
| - |
| + state->xid = inbuff[3] | inbuff[2] << 8 | inbuff[1] << 16; |
| + |
| /* We're going to be linking tags from all context we use. |
| mark them as unused so we don't link one twice and break the list */ |
| for (context_tmp = state->context; context_tmp; context_tmp = context_tmp->current) |
| @@ -347,7 +348,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_ |
| (msg_type == DHCP6REQUEST || msg_type == DHCP6RENEW || msg_type == DHCP6RELEASE || msg_type == DHCP6DECLINE)) |
| |
| { |
| - *outmsgtypep = DHCP6REPLY; |
| + outmsgtype = DHCP6REPLY; |
| o1 = new_opt6(OPTION6_STATUS_CODE); |
| put_opt6_short(DHCP6USEMULTI); |
| put_opt6_string("Use multicast"); |
| @@ -619,11 +620,11 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_ |
| struct dhcp_netid *solicit_tags; |
| struct dhcp_context *c; |
| |
| - *outmsgtypep = DHCP6ADVERTISE; |
| + outmsgtype = DHCP6ADVERTISE; |
| |
| if (opt6_find(state->packet_options, state->end, OPTION6_RAPID_COMMIT, 0)) |
| { |
| - *outmsgtypep = DHCP6REPLY; |
| + outmsgtype = DHCP6REPLY; |
| state->lease_allocate = 1; |
| o = new_opt6(OPTION6_RAPID_COMMIT); |
| end_opt6(o); |
| @@ -809,7 +810,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_ |
| int start = save_counter(-1); |
| |
| /* set reply message type */ |
| - *outmsgtypep = DHCP6REPLY; |
| + outmsgtype = DHCP6REPLY; |
| state->lease_allocate = 1; |
| |
| log6_quiet(state, "DHCPREQUEST", NULL, ignore ? _("ignored") : NULL); |
| @@ -924,7 +925,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_ |
| int address_assigned = 0; |
| |
| /* set reply message type */ |
| - *outmsgtypep = DHCP6REPLY; |
| + outmsgtype = DHCP6REPLY; |
| |
| log6_quiet(state, msg_type == DHCP6RENEW ? "DHCPRENEW" : "DHCPREBIND", NULL, NULL); |
| |
| @@ -1057,7 +1058,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_ |
| int good_addr = 0; |
| |
| /* set reply message type */ |
| - *outmsgtypep = DHCP6REPLY; |
| + outmsgtype = DHCP6REPLY; |
| |
| log6_quiet(state, "DHCPCONFIRM", NULL, NULL); |
| |
| @@ -1121,7 +1122,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_ |
| log6_quiet(state, "DHCPINFORMATION-REQUEST", NULL, ignore ? _("ignored") : state->hostname); |
| if (ignore) |
| return 0; |
| - *outmsgtypep = DHCP6REPLY; |
| + outmsgtype = DHCP6REPLY; |
| tagif = add_options(state, 1); |
| break; |
| } |
| @@ -1130,7 +1131,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_ |
| case DHCP6RELEASE: |
| { |
| /* set reply message type */ |
| - *outmsgtypep = DHCP6REPLY; |
| + outmsgtype = DHCP6REPLY; |
| |
| log6_quiet(state, "DHCPRELEASE", NULL, NULL); |
| |
| @@ -1195,7 +1196,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_ |
| case DHCP6DECLINE: |
| { |
| /* set reply message type */ |
| - *outmsgtypep = DHCP6REPLY; |
| + outmsgtype = DHCP6REPLY; |
| |
| log6_quiet(state, "DHCPDECLINE", NULL, NULL); |
| |
| @@ -1275,7 +1276,12 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_ |
| } |
| |
| } |
| - |
| + |
| + /* Fill in the message type. Note that we store the offset, |
| + not a direct pointer, since the packet memory may have been |
| + reallocated. */ |
| + ((unsigned char *)(daemon->outpacket.iov_base))[start_msg] = outmsgtype; |
| + |
| log_tags(tagif, state->xid); |
| log6_opts(0, state->xid, daemon->outpacket.iov_base + start_opts, daemon->outpacket.iov_base + save_counter(-1)); |
| |
| -- |
| 2.25.1 |
| |