yeahuh / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone
1072c8
From 8198ae7c21a4d37f7e365058f973867c41d44d21 Mon Sep 17 00:00:00 2001
1072c8
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
1072c8
Date: Thu, 29 Jul 2021 04:56:25 -0400
1072c8
Subject: [PATCH 06/14] bootp: limit vendor-specific area to input packet
1072c8
 memory buffer
1072c8
MIME-Version: 1.0
1072c8
Content-Type: text/plain; charset=UTF-8
1072c8
Content-Transfer-Encoding: 8bit
1072c8
1072c8
RH-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
1072c8
Message-id: <20210708082537.1550263-3-marcandre.lureau@redhat.com>
1072c8
Patchwork-id: 101821
1072c8
O-Subject: [RHEL-8.5.0 qemu-kvm PATCH 2/8] bootp: limit vendor-specific area to input packet memory buffer
1072c8
Bugzilla: 1970819 1970835 1970843 1970853
1072c8
RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
1072c8
RH-Acked-by: Eric Blake <eblake@redhat.com>
1072c8
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
1072c8
1072c8
From: Marc-André Lureau <marcandre.lureau@redhat.com>
1072c8
1072c8
sizeof(bootp_t) currently holds DHCP_OPT_LEN. Remove this optional field
1072c8
from the structure, to help with the following patch checking for
1072c8
minimal header size. Modify the bootp_reply() function to take the
1072c8
buffer boundaries and avoiding potential buffer overflow.
1072c8
1072c8
Related to CVE-2021-3592.
1072c8
1072c8
https://gitlab.freedesktop.org/slirp/libslirp/-/issues/44
1072c8
1072c8
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
1072c8
1072c8
(cherry picked from commit f13cad45b25d92760bb0ad67bec0300a4d7d5275)
1072c8
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
1072c8
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
1072c8
---
1072c8
 slirp/src/bootp.c | 26 +++++++++++++++-----------
1072c8
 slirp/src/bootp.h |  2 +-
1072c8
 slirp/src/mbuf.c  |  5 +++++
1072c8
 slirp/src/mbuf.h  |  1 +
1072c8
 4 files changed, 22 insertions(+), 12 deletions(-)
1072c8
1072c8
diff --git a/slirp/src/bootp.c b/slirp/src/bootp.c
1072c8
index 3f9ce2553e..5754327138 100644
1072c8
--- a/slirp/src/bootp.c
1072c8
+++ b/slirp/src/bootp.c
1072c8
@@ -92,21 +92,22 @@ found:
1072c8
     return bc;
1072c8
 }
1072c8
 
1072c8
-static void dhcp_decode(const struct bootp_t *bp, int *pmsg_type,
1072c8
+static void dhcp_decode(const struct bootp_t *bp,
1072c8
+                        const uint8_t *bp_end,
1072c8
+                        int *pmsg_type,
1072c8
                         struct in_addr *preq_addr)
1072c8
 {
1072c8
-    const uint8_t *p, *p_end;
1072c8
+    const uint8_t *p;
1072c8
     int len, tag;
1072c8
 
1072c8
     *pmsg_type = 0;
1072c8
     preq_addr->s_addr = htonl(0L);
1072c8
 
1072c8
     p = bp->bp_vend;
1072c8
-    p_end = p + DHCP_OPT_LEN;
1072c8
     if (memcmp(p, rfc1533_cookie, 4) != 0)
1072c8
         return;
1072c8
     p += 4;
1072c8
-    while (p < p_end) {
1072c8
+    while (p < bp_end) {
1072c8
         tag = p[0];
1072c8
         if (tag == RFC1533_PAD) {
1072c8
             p++;
1072c8
@@ -114,10 +115,10 @@ static void dhcp_decode(const struct bootp_t *bp, int *pmsg_type,
1072c8
             break;
1072c8
         } else {
1072c8
             p++;
1072c8
-            if (p >= p_end)
1072c8
+            if (p >= bp_end)
1072c8
                 break;
1072c8
             len = *p++;
1072c8
-            if (p + len > p_end) {
1072c8
+            if (p + len > bp_end) {
1072c8
                 break;
1072c8
             }
1072c8
             DPRINTF("dhcp: tag=%d len=%d\n", tag, len);
1072c8
@@ -144,7 +145,9 @@ static void dhcp_decode(const struct bootp_t *bp, int *pmsg_type,
1072c8
     }
1072c8
 }
1072c8
 
1072c8
-static void bootp_reply(Slirp *slirp, const struct bootp_t *bp)
1072c8
+static void bootp_reply(Slirp *slirp,
1072c8
+                        const struct bootp_t *bp,
1072c8
+                        const uint8_t *bp_end)
1072c8
 {
1072c8
     BOOTPClient *bc = NULL;
1072c8
     struct mbuf *m;
1072c8
@@ -157,7 +160,7 @@ static void bootp_reply(Slirp *slirp, const struct bootp_t *bp)
1072c8
     uint8_t client_ethaddr[ETH_ALEN];
1072c8
 
1072c8
     /* extract exact DHCP msg type */
1072c8
-    dhcp_decode(bp, &dhcp_msg_type, &preq_addr);
1072c8
+    dhcp_decode(bp, bp_end, &dhcp_msg_type, &preq_addr);
1072c8
     DPRINTF("bootp packet op=%d msgtype=%d", bp->bp_op, dhcp_msg_type);
1072c8
     if (preq_addr.s_addr != htonl(0L))
1072c8
         DPRINTF(" req_addr=%08" PRIx32 "\n", ntohl(preq_addr.s_addr));
1072c8
@@ -179,9 +182,10 @@ static void bootp_reply(Slirp *slirp, const struct bootp_t *bp)
1072c8
         return;
1072c8
     }
1072c8
     m->m_data += IF_MAXLINKHDR;
1072c8
+    m_inc(m, sizeof(struct bootp_t) + DHCP_OPT_LEN);
1072c8
     rbp = (struct bootp_t *)m->m_data;
1072c8
     m->m_data += sizeof(struct udpiphdr);
1072c8
-    memset(rbp, 0, sizeof(struct bootp_t));
1072c8
+    memset(rbp, 0, sizeof(struct bootp_t) + DHCP_OPT_LEN);
1072c8
 
1072c8
     if (dhcp_msg_type == DHCPDISCOVER) {
1072c8
         if (preq_addr.s_addr != htonl(0L)) {
1072c8
@@ -235,7 +239,7 @@ static void bootp_reply(Slirp *slirp, const struct bootp_t *bp)
1072c8
     rbp->bp_siaddr = saddr.sin_addr; /* Server IP address */
1072c8
 
1072c8
     q = rbp->bp_vend;
1072c8
-    end = (uint8_t *)&rbp[1];
1072c8
+    end = rbp->bp_vend + DHCP_OPT_LEN;
1072c8
     memcpy(q, rfc1533_cookie, 4);
1072c8
     q += 4;
1072c8
 
1072c8
@@ -365,6 +369,6 @@ void bootp_input(struct mbuf *m)
1072c8
     struct bootp_t *bp = mtod(m, struct bootp_t *);
1072c8
 
1072c8
     if (bp->bp_op == BOOTP_REQUEST) {
1072c8
-        bootp_reply(m->slirp, bp);
1072c8
+        bootp_reply(m->slirp, bp, m_end(m));
1072c8
     }
1072c8
 }
1072c8
diff --git a/slirp/src/bootp.h b/slirp/src/bootp.h
1072c8
index 03ece9bf28..0d20a944a8 100644
1072c8
--- a/slirp/src/bootp.h
1072c8
+++ b/slirp/src/bootp.h
1072c8
@@ -114,7 +114,7 @@ struct bootp_t {
1072c8
     uint8_t bp_hwaddr[16];
1072c8
     uint8_t bp_sname[64];
1072c8
     uint8_t bp_file[128];
1072c8
-    uint8_t bp_vend[DHCP_OPT_LEN];
1072c8
+    uint8_t bp_vend[];
1072c8
 };
1072c8
 
1072c8
 typedef struct {
1072c8
diff --git a/slirp/src/mbuf.c b/slirp/src/mbuf.c
1072c8
index 6d0653ed3d..7db07c088e 100644
1072c8
--- a/slirp/src/mbuf.c
1072c8
+++ b/slirp/src/mbuf.c
1072c8
@@ -233,3 +233,8 @@ void *mtod_check(struct mbuf *m, size_t len)
1072c8
 
1072c8
     return NULL;
1072c8
 }
1072c8
+
1072c8
+void *m_end(struct mbuf *m)
1072c8
+{
1072c8
+    return m->m_data + m->m_len;
1072c8
+}
1072c8
diff --git a/slirp/src/mbuf.h b/slirp/src/mbuf.h
1072c8
index 2015e3232f..a9752a36e0 100644
1072c8
--- a/slirp/src/mbuf.h
1072c8
+++ b/slirp/src/mbuf.h
1072c8
@@ -119,6 +119,7 @@ void m_adj(struct mbuf *, int);
1072c8
 int m_copy(struct mbuf *, struct mbuf *, int, int);
1072c8
 struct mbuf *dtom(Slirp *, void *);
1072c8
 void *mtod_check(struct mbuf *, size_t len);
1072c8
+void *m_end(struct mbuf *);
1072c8
 
1072c8
 static inline void ifs_init(struct mbuf *ifm)
1072c8
 {
1072c8
-- 
1072c8
2.27.0
1072c8