From 5d1b75b542f128f757606668a44ce60ebb3c47f0 Mon Sep 17 00:00:00 2001

From: Simon Kelley <simon@thekelleys.org.uk>

Date: Thu, 31 Mar 2022 21:35:20 +0100

Subject: [PATCH] Fix write-after-free error in DHCPv6 code. CVE-2022-0934

 refers.

---

 src/rfc3315.c | 48 +++++++++++++++++++++++++++---------------------

 1 file changed, 27 insertions(+), 21 deletions(-)

diff --git a/src/rfc3315.c b/src/rfc3315.c

index fbb6876..d2ebf15 100644

--- a/src/rfc3315.c

+++ b/src/rfc3315.c

@@ -33,9 +33,9 @@ struct state {

   unsigned int mac_len, mac_type;

 };

-static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz, 

+static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz, 

 			     struct in6_addr *client_addr, int is_unicast, time_t now);

-static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now);

+static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now);

 static void log6_opts(int nest, unsigned int xid, void *start_opts, void *end_opts);

 static void log6_packet(struct state *state, char *type, struct in6_addr *addr, char *string);

 static void log6_quiet(struct state *state, char *type, struct in6_addr *addr, char *string);

@@ -104,12 +104,12 @@ unsigned short dhcp6_reply(struct dhcp_context *context, int interface, char *if

 }

 /* This cost me blood to write, it will probably cost you blood to understand - srk. */

-static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz, 

+static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz, 

 			     struct in6_addr *client_addr, int is_unicast, time_t now)

 {

   void *end = inbuff + sz;

   void *opts = inbuff + 34;

-  int msg_type = *((unsigned char *)inbuff);

+  int msg_type = *inbuff;

   unsigned char *outmsgtypep;

   void *opt;

   struct dhcp_vendor *vendor;

@@ -259,15 +259,15 @@ static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,

   return 1;

 }

-static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now)

+static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now)

 {

   void *opt;

-  int i, o, o1, start_opts;

+  int i, o, o1, start_opts, start_msg;

   struct dhcp_opt *opt_cfg;

   struct dhcp_netid *tagif;

   struct dhcp_config *config = NULL;

   struct dhcp_netid known_id, iface_id, v6_id;

-  unsigned char *outmsgtypep;

+  unsigned char outmsgtype;

   struct dhcp_vendor *vendor;

   struct dhcp_context *context_tmp;

   struct dhcp_mac *mac_opt;

@@ -296,12 +296,13 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_

   v6_id.next = state->tags;

   state->tags = &v6_id;

-  /* copy over transaction-id, and save pointer to message type */

-  if (!(outmsgtypep = put_opt6(inbuff, 4)))

+  start_msg = save_counter(-1);

+  /* copy over transaction-id */

+  if (!put_opt6(inbuff, 4))

     return 0;

   start_opts = save_counter(-1);

-  state->xid = outmsgtypep[3] | outmsgtypep[2] << 8 | outmsgtypep[1] << 16;

-   

+  state->xid = inbuff[3] | inbuff[2] << 8 | inbuff[1] << 16;

+    

   /* We're going to be linking tags from all context we use. 

      mark them as unused so we don't link one twice and break the list */

   for (context_tmp = state->context; context_tmp; context_tmp = context_tmp->current)

@@ -347,7 +348,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_

       (msg_type == DHCP6REQUEST || msg_type == DHCP6RENEW || msg_type == DHCP6RELEASE || msg_type == DHCP6DECLINE))

     {  

-      *outmsgtypep = DHCP6REPLY;

+      outmsgtype = DHCP6REPLY;

       o1 = new_opt6(OPTION6_STATUS_CODE);

       put_opt6_short(DHCP6USEMULTI);

       put_opt6_string("Use multicast");

@@ -619,11 +620,11 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_

 	struct dhcp_netid *solicit_tags;

 	struct dhcp_context *c;

-	*outmsgtypep = DHCP6ADVERTISE;

+	outmsgtype = DHCP6ADVERTISE;

 	if (opt6_find(state->packet_options, state->end, OPTION6_RAPID_COMMIT, 0))

 	  {

-	    *outmsgtypep = DHCP6REPLY;

+	    outmsgtype = DHCP6REPLY;

 	    state->lease_allocate = 1;

 	    o = new_opt6(OPTION6_RAPID_COMMIT);

 	    end_opt6(o);

@@ -826,7 +827,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_

 	int start = save_counter(-1);

 	/* set reply message type */

-	*outmsgtypep = DHCP6REPLY;

+	outmsgtype = DHCP6REPLY;

 	state->lease_allocate = 1;

 	log6_quiet(state, "DHCPREQUEST", NULL, ignore ? _("ignored") : NULL);

@@ -938,7 +939,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_

     case DHCP6RENEW:

       {

 	/* set reply message type */

-	*outmsgtypep = DHCP6REPLY;

+	outmsgtype = DHCP6REPLY;

 	log6_quiet(state, "DHCPRENEW", NULL, NULL);

@@ -1050,7 +1051,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_

 	int good_addr = 0;

 	/* set reply message type */

-	*outmsgtypep = DHCP6REPLY;

+	outmsgtype = DHCP6REPLY;

 	log6_quiet(state, "DHCPCONFIRM", NULL, NULL);

@@ -1114,7 +1115,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_

 	log6_quiet(state, "DHCPINFORMATION-REQUEST", NULL, ignore ? _("ignored") : state->hostname);

 	if (ignore)

 	  return 0;

-	*outmsgtypep = DHCP6REPLY;

+	outmsgtype = DHCP6REPLY;

 	tagif = add_options(state, 1);

 	break;

       }

@@ -1123,7 +1124,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_

     case DHCP6RELEASE:

       {

 	/* set reply message type */

-	*outmsgtypep = DHCP6REPLY;

+	outmsgtype = DHCP6REPLY;

 	log6_quiet(state, "DHCPRELEASE", NULL, NULL);

@@ -1188,7 +1189,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_

     case DHCP6DECLINE:

       {

 	/* set reply message type */

-	*outmsgtypep = DHCP6REPLY;

+	outmsgtype = DHCP6REPLY;

 	log6_quiet(state, "DHCPDECLINE", NULL, NULL);

@@ -1268,7 +1269,12 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_

       }

     }

-  

+

+  /* Fill in the message type. Note that we store the offset,

+     not a direct pointer, since the packet memory may have been 

+     reallocated. */

+  ((unsigned char *)(daemon->outpacket.iov_base))[start_msg] = outmsgtype;

+

   log_tags(tagif, state->xid);

   log6_opts(0, state->xid, daemon->outpacket.iov_base + start_opts, daemon->outpacket.iov_base + save_counter(-1));

-- 

2.39.1