git.openwrt.org Git - openwrt/staging/ansuel.git/blob

   1 From 03345ecefeb0d82e3c3a4c28f27c3554f0611b39 Mon Sep 17 00:00:00 2001
   2 From: Simon Kelley <simon@thekelleys.org.uk>
   3 Date: Thu, 31 Mar 2022 21:35:20 +0100
   4 Subject: Fix write-after-free error in DHCPv6 code. CVE-2022-0934 refers.
   5
   6 ---
   7  CHANGELOG     |  3 +++
   8  src/rfc3315.c | 48 +++++++++++++++++++++++++++---------------------
   9  2 files changed, 30 insertions(+), 21 deletions(-)
  10
  11 --- a/CHANGELOG
  12 +++ b/CHANGELOG
  13 @@ -92,6 +92,9 @@ version 2.86
  14         of filename). Thanks to Ed Wildgoose for the initial patch
  15         and motivation for this.
  16
  17 +       Fix write-after-free error in DHCPv6 server code.
  18 +       CVE-2022-0934 refers.
  19 +
  20
  21  version 2.85
  22          Fix problem with DNS retries in 2.83/2.84.
  23 --- a/src/rfc3315.c
  24 +++ b/src/rfc3315.c
  25 @@ -33,9 +33,9 @@ struct state {
  26    unsigned int mac_len, mac_type;
  27  };
  28
  29 -static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,
  30 +static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz,
  31                              struct in6_addr *client_addr, int is_unicast, time_t now);
  32 -static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now);
  33 +static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now);
  34  static void log6_opts(int nest, unsigned int xid, void *start_opts, void *end_opts);
  35  static void log6_packet(struct state *state, char *type, struct in6_addr *addr, char *string);
  36  static void log6_quiet(struct state *state, char *type, struct in6_addr *addr, char *string);
  37 @@ -104,12 +104,12 @@ unsigned short dhcp6_reply(struct dhcp_c
  38  }
  39
  40  /* This cost me blood to write, it will probably cost you blood to understand - srk. */
  41 -static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,
  42 +static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz,
  43                              struct in6_addr *client_addr, int is_unicast, time_t now)
  44  {
  45    void *end = inbuff + sz;
  46    void *opts = inbuff + 34;
  47 -  int msg_type = *((unsigned char *)inbuff);
  48 +  int msg_type = *inbuff;
  49    unsigned char *outmsgtypep;
  50    void *opt;
  51    struct dhcp_vendor *vendor;
  52 @@ -259,15 +259,15 @@ static int dhcp6_maybe_relay(struct stat
  53    return 1;
  54  }
  55
  56 -static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now)
  57 +static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now)
  58  {
  59    void *opt;
  60 -  int i, o, o1, start_opts;
  61 +  int i, o, o1, start_opts, start_msg;
  62    struct dhcp_opt *opt_cfg;
  63    struct dhcp_netid *tagif;
  64    struct dhcp_config *config = NULL;
  65    struct dhcp_netid known_id, iface_id, v6_id;
  66 -  unsigned char *outmsgtypep;
  67 +  unsigned char outmsgtype;
  68    struct dhcp_vendor *vendor;
  69    struct dhcp_context *context_tmp;
  70    struct dhcp_mac *mac_opt;
  71 @@ -296,12 +296,13 @@ static int dhcp6_no_relay(struct state *
  72    v6_id.next = state->tags;
  73    state->tags = &v6_id;
  74
  75 -  /* copy over transaction-id, and save pointer to message type */
  76 -  if (!(outmsgtypep = put_opt6(inbuff, 4)))
  77 +  start_msg = save_counter(-1);
  78 +  /* copy over transaction-id */
  79 +  if (!put_opt6(inbuff, 4))
  80      return 0;
  81    start_opts = save_counter(-1);
  82 -  state->xid = outmsgtypep[3] | outmsgtypep[2] << 8 | outmsgtypep[1] << 16;
  83 -
  84 +  state->xid = inbuff[3] | inbuff[2] << 8 | inbuff[1] << 16;
  85 +
  86    /* We're going to be linking tags from all context we use.
  87       mark them as unused so we don't link one twice and break the list */
  88    for (context_tmp = state->context; context_tmp; context_tmp = context_tmp->current)
  89 @@ -347,7 +348,7 @@ static int dhcp6_no_relay(struct state *
  90        (msg_type == DHCP6REQUEST || msg_type == DHCP6RENEW || msg_type == DHCP6RELEASE || msg_type == DHCP6DECLINE))
  91
  92      {
  93 -      *outmsgtypep = DHCP6REPLY;
  94 +      outmsgtype = DHCP6REPLY;
  95        o1 = new_opt6(OPTION6_STATUS_CODE);
  96        put_opt6_short(DHCP6USEMULTI);
  97        put_opt6_string("Use multicast");
  98 @@ -619,11 +620,11 @@ static int dhcp6_no_relay(struct state *
  99         struct dhcp_netid *solicit_tags;
 100         struct dhcp_context *c;
 101
 102 -       *outmsgtypep = DHCP6ADVERTISE;
 103 +       outmsgtype = DHCP6ADVERTISE;
 104
 105         if (opt6_find(state->packet_options, state->end, OPTION6_RAPID_COMMIT, 0))
 106           {
 107 -           *outmsgtypep = DHCP6REPLY;
 108 +           outmsgtype = DHCP6REPLY;
 109             state->lease_allocate = 1;
 110             o = new_opt6(OPTION6_RAPID_COMMIT);
 111             end_opt6(o);
 112 @@ -809,7 +810,7 @@ static int dhcp6_no_relay(struct state *
 113         int start = save_counter(-1);
 114
 115         /* set reply message type */
 116 -       *outmsgtypep = DHCP6REPLY;
 117 +       outmsgtype = DHCP6REPLY;
 118         state->lease_allocate = 1;
 119
 120         log6_quiet(state, "DHCPREQUEST", NULL, ignore ? _("ignored") : NULL);
 121 @@ -924,7 +925,7 @@ static int dhcp6_no_relay(struct state *
 122         int address_assigned = 0;
 123
 124         /* set reply message type */
 125 -       *outmsgtypep = DHCP6REPLY;
 126 +       outmsgtype = DHCP6REPLY;
 127
 128         log6_quiet(state, msg_type == DHCP6RENEW ? "DHCPRENEW" : "DHCPREBIND", NULL, NULL);
 129
 130 @@ -1057,7 +1058,7 @@ static int dhcp6_no_relay(struct state *
 131         int good_addr = 0;
 132
 133         /* set reply message type */
 134 -       *outmsgtypep = DHCP6REPLY;
 135 +       outmsgtype = DHCP6REPLY;
 136
 137         log6_quiet(state, "DHCPCONFIRM", NULL, NULL);
 138
 139 @@ -1121,7 +1122,7 @@ static int dhcp6_no_relay(struct state *
 140         log6_quiet(state, "DHCPINFORMATION-REQUEST", NULL, ignore ? _("ignored") : state->hostname);
 141         if (ignore)
 142           return 0;
 143 -       *outmsgtypep = DHCP6REPLY;
 144 +       outmsgtype = DHCP6REPLY;
 145         tagif = add_options(state, 1);
 146         break;
 147        }
 148 @@ -1130,7 +1131,7 @@ static int dhcp6_no_relay(struct state *
 149      case DHCP6RELEASE:
 150        {
 151         /* set reply message type */
 152 -       *outmsgtypep = DHCP6REPLY;
 153 +       outmsgtype = DHCP6REPLY;
 154
 155         log6_quiet(state, "DHCPRELEASE", NULL, NULL);
 156
 157 @@ -1195,7 +1196,7 @@ static int dhcp6_no_relay(struct state *
 158      case DHCP6DECLINE:
 159        {
 160         /* set reply message type */
 161 -       *outmsgtypep = DHCP6REPLY;
 162 +       outmsgtype = DHCP6REPLY;
 163
 164         log6_quiet(state, "DHCPDECLINE", NULL, NULL);
 165
 166 @@ -1275,7 +1276,12 @@ static int dhcp6_no_relay(struct state *
 167        }
 168
 169      }
 170 -
 171 +
 172 +  /* Fill in the message type. Note that we store the offset,
 173 +     not a direct pointer, since the packet memory may have been
 174 +     reallocated. */
 175 +  ((unsigned char *)(daemon->outpacket.iov_base))[start_msg] = outmsgtype;
 176 +
 177    log_tags(tagif, state->xid);
 178    log6_opts(0, state->xid, daemon->outpacket.iov_base + start_opts, daemon->outpacket.iov_base + save_counter(-1));
 179