|
 |
a03026 |
From 5ab67e936085a9e584c9b3e43f442ef5bee7f40e Mon Sep 17 00:00:00 2001
|
|
|
a03026 |
From: Simon Kelley <simon@thekelleys.org.uk>
|
|
|
a03026 |
Date: Mon, 25 Sep 2017 20:11:58 +0100
|
|
|
a03026 |
Subject: [PATCH 5/9] Security fix, CVE-2017-14496, Integer underflow in
|
|
|
a03026 |
DNS response creation.
|
|
|
a03026 |
|
|
|
a03026 |
Fix DoS in DNS. Invalid boundary checks in the
|
|
|
a03026 |
add_pseudoheader function allows a memcpy call with negative
|
|
|
a03026 |
size An attacker which can send malicious DNS queries
|
|
|
a03026 |
to dnsmasq can trigger a DoS remotely.
|
|
|
a03026 |
dnsmasq is vulnerable only if one of the following option is
|
|
|
a03026 |
specified: --add-mac, --add-cpe-id or --add-subnet.
|
|
|
a03026 |
---
|
|
|
a03026 |
src/edns0.c | 13 ++++++++++++-
|
|
|
a03026 |
1 file changed, 12 insertions(+), 1 deletion(-)
|
|
|
a03026 |
|
|
|
a03026 |
diff --git a/src/edns0.c b/src/edns0.c
|
|
|
a03026 |
index d2b514b..eed135e 100644
|
|
|
a03026 |
--- a/src/edns0.c
|
|
|
a03026 |
+++ b/src/edns0.c
|
|
|
a03026 |
@@ -144,7 +144,7 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
|
|
|
a03026 |
GETSHORT(len, p);
|
|
|
a03026 |
|
|
|
a03026 |
/* malformed option, delete the whole OPT RR and start again. */
|
|
|
a03026 |
- if (i + len > rdlen)
|
|
|
a03026 |
+ if (i + 4 + len > rdlen)
|
|
|
a03026 |
{
|
|
|
a03026 |
rdlen = 0;
|
|
|
a03026 |
is_last = 0;
|
|
|
a03026 |
@@ -193,6 +193,8 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
|
|
|
a03026 |
ntohs(header->ancount) + ntohs(header->nscount) + ntohs(header->arcount),
|
|
|
a03026 |
header, plen)))
|
|
|
a03026 |
return plen;
|
|
|
a03026 |
+ if (p + 11 > limit)
|
|
|
a03026 |
+ return plen; /* Too big */
|
|
|
a03026 |
*p++ = 0; /* empty name */
|
|
|
a03026 |
PUTSHORT(T_OPT, p);
|
|
|
a03026 |
PUTSHORT(udp_sz, p); /* max packet length, 512 if not given in EDNS0 header */
|
|
|
a03026 |
@@ -204,6 +206,11 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
|
|
|
a03026 |
/* Copy back any options */
|
|
|
a03026 |
if (buff)
|
|
|
a03026 |
{
|
|
|
a03026 |
+ if (p + rdlen > limit)
|
|
|
a03026 |
+ {
|
|
|
a03026 |
+ free(buff);
|
|
|
a03026 |
+ return plen; /* Too big */
|
|
|
a03026 |
+ }
|
|
|
a03026 |
memcpy(p, buff, rdlen);
|
|
|
a03026 |
free(buff);
|
|
|
a03026 |
p += rdlen;
|
|
|
a03026 |
@@ -217,8 +224,12 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
|
|
|
a03026 |
/* Add new option */
|
|
|
a03026 |
if (optno != 0 && replace != 2)
|
|
|
a03026 |
{
|
|
|
a03026 |
+ if (p + 4 > limit)
|
|
|
a03026 |
+ return plen; /* Too big */
|
|
|
a03026 |
PUTSHORT(optno, p);
|
|
|
a03026 |
PUTSHORT(optlen, p);
|
|
|
a03026 |
+ if (p + optlen > limit)
|
|
|
a03026 |
+ return plen; /* Too big */
|
|
|
a03026 |
memcpy(p, opt, optlen);
|
|
|
a03026 |
p += optlen;
|
|
|
a03026 |
PUTSHORT(p - datap, lenp);
|
|
|
a03026 |
--
|
|
|
a03026 |
2.9.5
|
|
|
a03026 |
|