blob: 6ba80ac9db40c13f86db7b7363408d1a100eb004 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
commit ed28cde3d8bf3f1459b2f42f0e27d64801009f92
Author: Gert Doering <gert@greenie.muc.de>
Date: Tue Jun 13 22:08:32 2017 +0200
Fix remotely-triggerable ASSERT() on malformed IPv6 packet.
Correct sanity checks on IPv6 packet length in mss_fixup_ipv6(),
and change the ASSERT() check in mss_fixup_dowork() into a simple
"return" (= the TCP header will simply not be inspected further).
CVE-2017-7508 has been assigned due to the serious nature of the
bug: it can be used to remotely shutdown an openvpn server or
client, if IPv6 and --mssfix are enabled and the IPv6 networks used
inside the VPN are known.
Found by Guido Vranken <guidovranken@gmail.com>.
v2: style changes
CVE: 2017-7508
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <20170613200832.15027-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/search?l=mid&q=20170613200832.15027-1-gert@greenie.muc.de
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit c3f47077a7756de5929094569421a95aa66f2022)
Index: openvpn-2.4.0/src/openvpn/mss.c
===================================================================
--- openvpn-2.4.0.orig/src/openvpn/mss.c
+++ openvpn-2.4.0/src/openvpn/mss.c
@@ -120,8 +120,12 @@ mss_fixup_ipv6(struct buffer *buf, int m
return;
}
+ /* skip IPv6 header (40 bytes),
+ * verify remainder is large enough to contain a full TCP header
+ */
newbuf = *buf;
- if (buf_advance( &newbuf, 40 ) )
+ if (buf_advance( &newbuf, 40 )
+ && BLEN(&newbuf) >= (int) sizeof(struct openvpn_tcphdr))
{
struct openvpn_tcphdr *tc = (struct openvpn_tcphdr *) BPTR(&newbuf);
if (tc->flags & OPENVPN_TCPH_SYN_MASK)
@@ -145,7 +149,10 @@ mss_fixup_dowork(struct buffer *buf, uin
int accumulate;
struct openvpn_tcphdr *tc;
- ASSERT(BLEN(buf) >= (int) sizeof(struct openvpn_tcphdr));
+ if (BLEN(buf) < (int) sizeof(struct openvpn_tcphdr))
+ {
+ return;
+ }
verify_align_4(buf);
tc = (struct openvpn_tcphdr *) BPTR(buf);
|
