From 3637e1aa7ac62f0bba5e9a196e42f22cb93a498b Mon Sep 17 00:00:00 2001 From: Alberto Gonzalez Iniesta Date: Thu, 22 Jun 2017 18:00:56 +0200 Subject: Import Debian changes 2.4.0-6+deb9u1 openvpn (2.4.0-6+deb9u1) stretch-security; urgency=high * SECURITY UPDATE: (Closes: #865480) - CVE-2017-7508.patch. Fix remotely-triggerable ASSERT() on malformed IPv6 packet. - CVE-2017-7520.patch. Prevent two kinds of stack buffer OOB reads and a crash for invalid input data. - CVE-2017-7521.patch. Fix potential double-free in --x509-alt-username. - CVE-2017-7521bis.patch. Fix remote-triggerable memory leaks. --- debian/patches/CVE-2017-7508.patch | 57 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 debian/patches/CVE-2017-7508.patch (limited to 'debian/patches/CVE-2017-7508.patch') diff --git a/debian/patches/CVE-2017-7508.patch b/debian/patches/CVE-2017-7508.patch new file mode 100644 index 0000000..6ba80ac --- /dev/null +++ b/debian/patches/CVE-2017-7508.patch @@ -0,0 +1,57 @@ +commit ed28cde3d8bf3f1459b2f42f0e27d64801009f92 +Author: Gert Doering +Date: Tue Jun 13 22:08:32 2017 +0200 + + Fix remotely-triggerable ASSERT() on malformed IPv6 packet. + + Correct sanity checks on IPv6 packet length in mss_fixup_ipv6(), + and change the ASSERT() check in mss_fixup_dowork() into a simple + "return" (= the TCP header will simply not be inspected further). + + CVE-2017-7508 has been assigned due to the serious nature of the + bug: it can be used to remotely shutdown an openvpn server or + client, if IPv6 and --mssfix are enabled and the IPv6 networks used + inside the VPN are known. + + Found by Guido Vranken . + + v2: style changes + + CVE: 2017-7508 + Signed-off-by: Gert Doering + Acked-by: Steffan Karger + Message-Id: <20170613200832.15027-1-gert@greenie.muc.de> + URL: https://www.mail-archive.com/search?l=mid&q=20170613200832.15027-1-gert@greenie.muc.de + Signed-off-by: Gert Doering + (cherry picked from commit c3f47077a7756de5929094569421a95aa66f2022) + +Index: openvpn-2.4.0/src/openvpn/mss.c +=================================================================== +--- openvpn-2.4.0.orig/src/openvpn/mss.c ++++ openvpn-2.4.0/src/openvpn/mss.c +@@ -120,8 +120,12 @@ mss_fixup_ipv6(struct buffer *buf, int m + return; + } + ++ /* skip IPv6 header (40 bytes), ++ * verify remainder is large enough to contain a full TCP header ++ */ + newbuf = *buf; +- if (buf_advance( &newbuf, 40 ) ) ++ if (buf_advance( &newbuf, 40 ) ++ && BLEN(&newbuf) >= (int) sizeof(struct openvpn_tcphdr)) + { + struct openvpn_tcphdr *tc = (struct openvpn_tcphdr *) BPTR(&newbuf); + if (tc->flags & OPENVPN_TCPH_SYN_MASK) +@@ -145,7 +149,10 @@ mss_fixup_dowork(struct buffer *buf, uin + int accumulate; + struct openvpn_tcphdr *tc; + +- ASSERT(BLEN(buf) >= (int) sizeof(struct openvpn_tcphdr)); ++ if (BLEN(buf) < (int) sizeof(struct openvpn_tcphdr)) ++ { ++ return; ++ } + + verify_align_4(buf); + tc = (struct openvpn_tcphdr *) BPTR(buf); -- cgit v1.2.3