summaryrefslogtreecommitdiff
path: root/debian/patches/CVE-2017-7508.patch
diff options
context:
space:
mode:
authorJörg Frings-Fürst <debian@jff-webhosting.net>2017-10-02 07:00:36 +0200
committerJörg Frings-Fürst <debian@jff-webhosting.net>2017-10-02 07:00:36 +0200
commit3804bc2606a92e2f2f4b3a2b043af0d77d92b386 (patch)
treead5df7aa0b975693a09335d296ee56457ef6076e /debian/patches/CVE-2017-7508.patch
parent749384a154025e268b53cf3cc79eaeddde2b3ceb (diff)
parent678cfd249add7ca758e4c41933c7b730132c99f4 (diff)
Merge branch 'stretch' of ssh://git.debian.org/git/collab-maint/openvpn into stretchstretch
Diffstat (limited to 'debian/patches/CVE-2017-7508.patch')
-rw-r--r--debian/patches/CVE-2017-7508.patch57
1 files changed, 57 insertions, 0 deletions
diff --git a/debian/patches/CVE-2017-7508.patch b/debian/patches/CVE-2017-7508.patch
new file mode 100644
index 0000000..6ba80ac
--- /dev/null
+++ b/debian/patches/CVE-2017-7508.patch
@@ -0,0 +1,57 @@
+commit ed28cde3d8bf3f1459b2f42f0e27d64801009f92
+Author: Gert Doering <gert@greenie.muc.de>
+Date: Tue Jun 13 22:08:32 2017 +0200
+
+ Fix remotely-triggerable ASSERT() on malformed IPv6 packet.
+
+ Correct sanity checks on IPv6 packet length in mss_fixup_ipv6(),
+ and change the ASSERT() check in mss_fixup_dowork() into a simple
+ "return" (= the TCP header will simply not be inspected further).
+
+ CVE-2017-7508 has been assigned due to the serious nature of the
+ bug: it can be used to remotely shutdown an openvpn server or
+ client, if IPv6 and --mssfix are enabled and the IPv6 networks used
+ inside the VPN are known.
+
+ Found by Guido Vranken <guidovranken@gmail.com>.
+
+ v2: style changes
+
+ CVE: 2017-7508
+ Signed-off-by: Gert Doering <gert@greenie.muc.de>
+ Acked-by: Steffan Karger <steffan.karger@fox-it.com>
+ Message-Id: <20170613200832.15027-1-gert@greenie.muc.de>
+ URL: https://www.mail-archive.com/search?l=mid&q=20170613200832.15027-1-gert@greenie.muc.de
+ Signed-off-by: Gert Doering <gert@greenie.muc.de>
+ (cherry picked from commit c3f47077a7756de5929094569421a95aa66f2022)
+
+Index: openvpn-2.4.0/src/openvpn/mss.c
+===================================================================
+--- openvpn-2.4.0.orig/src/openvpn/mss.c
++++ openvpn-2.4.0/src/openvpn/mss.c
+@@ -120,8 +120,12 @@ mss_fixup_ipv6(struct buffer *buf, int m
+ return;
+ }
+
++ /* skip IPv6 header (40 bytes),
++ * verify remainder is large enough to contain a full TCP header
++ */
+ newbuf = *buf;
+- if (buf_advance( &newbuf, 40 ) )
++ if (buf_advance( &newbuf, 40 )
++ && BLEN(&newbuf) >= (int) sizeof(struct openvpn_tcphdr))
+ {
+ struct openvpn_tcphdr *tc = (struct openvpn_tcphdr *) BPTR(&newbuf);
+ if (tc->flags & OPENVPN_TCPH_SYN_MASK)
+@@ -145,7 +149,10 @@ mss_fixup_dowork(struct buffer *buf, uin
+ int accumulate;
+ struct openvpn_tcphdr *tc;
+
+- ASSERT(BLEN(buf) >= (int) sizeof(struct openvpn_tcphdr));
++ if (BLEN(buf) < (int) sizeof(struct openvpn_tcphdr))
++ {
++ return;
++ }
+
+ verify_align_4(buf);
+ tc = (struct openvpn_tcphdr *) BPTR(buf);