diff options
Diffstat (limited to 'debian/patches/CVE-2017-7508.patch')
-rw-r--r-- | debian/patches/CVE-2017-7508.patch | 57 |
1 files changed, 57 insertions, 0 deletions
diff --git a/debian/patches/CVE-2017-7508.patch b/debian/patches/CVE-2017-7508.patch new file mode 100644 index 0000000..f096553 --- /dev/null +++ b/debian/patches/CVE-2017-7508.patch @@ -0,0 +1,57 @@ +commit fc61d1bda112ffc669dbde961fab19f60b3c7439 +Author: Gert Doering <gert@greenie.muc.de> +Date: Tue Jun 13 22:08:32 2017 +0200 + + Fix remotely-triggerable ASSERT() on malformed IPv6 packet. + + Correct sanity checks on IPv6 packet length in mss_fixup_ipv6(), + and change the ASSERT() check in mss_fixup_dowork() into a simple + "return" (= the TCP header will simply not be inspected further). + + CVE-2017-7508 has been assigned due to the serious nature of the + bug: it can be used to remotely shutdown an openvpn server or + client, if IPv6 and --mssfix are enabled and the IPv6 networks used + inside the VPN are known. + + Found by Guido Vranken <guidovranken@gmail.com>. + + v2: style changes + + CVE: 2017-7508 + Signed-off-by: Gert Doering <gert@greenie.muc.de> + Acked-by: Steffan Karger <steffan.karger@fox-it.com> + Message-Id: <20170613200832.15027-1-gert@greenie.muc.de> + URL: https://www.mail-archive.com/search?l=mid&q=20170613200832.15027-1-gert@greenie.muc.de + Signed-off-by: Gert Doering <gert@greenie.muc.de> + (cherry picked from commit c3f47077a7756de5929094569421a95aa66f2022) + +diff --git a/src/openvpn/mss.c b/src/openvpn/mss.c +index f930942a..c91751d1 100644 +--- a/src/openvpn/mss.c ++++ b/src/openvpn/mss.c +@@ -110,8 +110,12 @@ mss_fixup_ipv6 (struct buffer *buf, int maxmss) + if ( pip6->nexthdr != OPENVPN_IPPROTO_TCP ) + return; + ++ /* skip IPv6 header (40 bytes), ++ * verify remainder is large enough to contain a full TCP header ++ */ + newbuf = *buf; +- if ( buf_advance( &newbuf, 40 ) ) ++ if (buf_advance( &newbuf, 40 ) ++ && BLEN(&newbuf) >= (int) sizeof(struct openvpn_tcphdr)) + { + struct openvpn_tcphdr *tc = (struct openvpn_tcphdr *) BPTR (&newbuf); + if (tc->flags & OPENVPN_TCPH_SYN_MASK) +@@ -133,7 +137,10 @@ mss_fixup_dowork (struct buffer *buf, uint16_t maxmss) + int accumulate; + struct openvpn_tcphdr *tc; + +- ASSERT (BLEN (buf) >= (int) sizeof (struct openvpn_tcphdr)); ++ if (BLEN(buf) < (int) sizeof(struct openvpn_tcphdr)) ++ { ++ return; ++ } + + verify_align_4 (buf); + tc = (struct openvpn_tcphdr *) BPTR (buf); |