diff --git a/SOURCES/openslp-2.0.0-cve-2019-5544.patch b/SOURCES/openslp-2.0.0-cve-2019-5544.patch new file mode 100644 index 0000000..d5268ef --- /dev/null +++ b/SOURCES/openslp-2.0.0-cve-2019-5544.patch @@ -0,0 +1,165 @@ +diff -up openslp-2.0.0/common/slp_buffer.c.orig openslp-2.0.0/common/slp_buffer.c +--- openslp-2.0.0/common/slp_buffer.c.orig 2012-12-11 00:31:53.000000000 +0100 ++++ openslp-2.0.0/common/slp_buffer.c 2019-12-09 10:39:16.422058793 +0100 +@@ -30,6 +30,13 @@ + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + *-------------------------------------------------------------------------*/ + ++/* Copyright (c) 2019 VMware, Inc. ++ * SPDX-License-Identifier: BSD-3-Clause ++ * This file is provided under the BSD-3-Clause license. ++ * See COPYING file for more details and other copyrights ++ * that may apply. ++ */ ++ + /** Functions for managing SLP message buffers. + * + * This file provides a higher level abstraction over malloc and free that +@@ -153,4 +160,20 @@ void SLPBufferFree(SLPBuffer buf) + xfree(buf); + } + ++/** Report remaining free buffer size in bytes. ++ * ++ * Check if buffer is allocated and if so return bytes left in a ++ * @c SLPBuffer object. ++ * ++ * @param[in] buf The SLPBuffer to be freed. ++ */ ++size_t ++RemainingBufferSpace(SLPBuffer buf) ++{ ++ if (buf->allocated == 0) { ++ return 0; ++ } ++ return buf->end - buf->curpos; ++} ++ + /*=========================================================================*/ +diff -up openslp-2.0.0/common/slp_buffer.h.orig openslp-2.0.0/common/slp_buffer.h +--- openslp-2.0.0/common/slp_buffer.h.orig 2012-11-28 18:07:04.000000000 +0100 ++++ openslp-2.0.0/common/slp_buffer.h 2019-12-09 10:39:16.422058793 +0100 +@@ -30,6 +30,13 @@ + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + *-------------------------------------------------------------------------*/ + ++/* Copyright (c) 2019 VMware, Inc. ++ * SPDX-License-Identifier: BSD-3-Clause ++ * This file is provided under the BSD-3-Clause license. ++ * See COPYING file for more details and other copyrights ++ * that may apply. ++ */ ++ + /** Header file that defines SLP message buffer management routines. + * + * Includes structures, constants and functions that used to handle memory +@@ -78,6 +85,8 @@ SLPBuffer SLPBufferListRemove(SLPBuffer + + SLPBuffer SLPBufferListAdd(SLPBuffer * list, SLPBuffer buf); + ++size_t RemainingBufferSpace(SLPBuffer buf); ++ + /*! @} */ + + #endif /* SLP_BUFFER_H_INCLUDED */ +diff -up openslp-2.0.0/slpd/slpd_process.c.orig openslp-2.0.0/slpd/slpd_process.c +--- openslp-2.0.0/slpd/slpd_process.c.orig 2019-12-09 10:39:16.420058789 +0100 ++++ openslp-2.0.0/slpd/slpd_process.c 2019-12-09 10:39:16.422058793 +0100 +@@ -30,6 +30,13 @@ + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + *-------------------------------------------------------------------------*/ + ++/* Copyright (c) 2019 VMware, Inc. ++ * SPDX-License-Identifier: BSD-3-Clause ++ * This file is provided under the BSD-3-Clause license. ++ * See COPYING file for more details and other copyrights ++ * that may apply. ++ */ ++ + /** Processes incoming SLP messages. + * + * @file slpd_process.c +@@ -523,13 +530,27 @@ RESPOND: + { + for (i = 0; i < db->urlcount; i++) + { +- /* urlentry is the url from the db result */ + urlentry = db->urlarray[i]; ++ if (urlentry->opaque != NULL) { ++ const int64_t newsize = size + urlentry->opaquelen; ++ if (urlentry->opaquelen <= 0 || newsize > INT_MAX) ++ { ++ SLPDLog("Invalid opaquelen %d or sizeo of opaque url is too big, size=%d\n", ++ urlentry->opaquelen, size); ++ errorcode = SLP_ERROR_PARSE_ERROR; ++ goto FINISHED; ++ } ++ size += urlentry->opaquelen; ++ } ++ else ++ { ++ /* urlentry is the url from the db result */ ++ size += urlentry->urllen + 6; /* 1 byte for reserved */ ++ /* 2 bytes for lifetime */ ++ /* 2 bytes for urllen */ ++ /* 1 byte for authcount */ ++ } + +- size += urlentry->urllen + 6; /* 1 byte for reserved */ +- /* 2 bytes for lifetime */ +- /* 2 bytes for urllen */ +- /* 1 byte for authcount */ + #ifdef ENABLE_SLPv2_SECURITY + /* make room to include the authblock that was asked for */ + if (G_SlpdProperty.securityEnabled +@@ -603,7 +624,7 @@ RESPOND: + urlentry = db->urlarray[i]; + + #ifdef ENABLE_SLPv1 +- if (urlentry->opaque == 0) ++ if (urlentry->opaque == NULL) + { + /* url-entry reserved */ + *result->curpos++ = 0; +@@ -615,8 +636,18 @@ RESPOND: + PutUINT16(&result->curpos, urlentry->urllen); + + /* url-entry url */ +- memcpy(result->curpos, urlentry->url, urlentry->urllen); +- result->curpos += urlentry->urllen; ++ if (RemainingBufferSpace(result) >= urlentry->urllen) ++ { ++ memcpy(result->curpos, urlentry->url, urlentry->urllen); ++ result->curpos = result->curpos + urlentry->urllen; ++ } ++ else ++ { ++ SLPDLog("Url too big (ask: %d have %" PRId64 "), failing request\n", ++ urlentry->opaquelen, (int64_t) RemainingBufferSpace(result)); ++ errorcode = SLP_ERROR_PARSE_ERROR; ++ goto FINISHED; ++ } + + /* url-entry auths */ + *result->curpos++ = 0; +@@ -630,8 +661,18 @@ RESPOND: + + /* TRICKY: Fix up the lifetime. */ + TO_UINT16(urlentry->opaque + 1, urlentry->lifetime); +- memcpy(result->curpos, urlentry->opaque, urlentry->opaquelen); +- result->curpos += urlentry->opaquelen; ++ if (RemainingBufferSpace(result) >= urlentry->opaquelen) ++ { ++ memcpy(result->curpos, urlentry->opaque, urlentry->opaquelen); ++ result->curpos = result->curpos + urlentry->opaquelen; ++ } ++ else ++ { ++ SLPDLog("Opaque Url too big (ask: %d have %" PRId64 "), failing request\n", ++ urlentry->opaquelen, (int64_t) RemainingBufferSpace(result)); ++ errorcode = SLP_ERROR_PARSE_ERROR; ++ goto FINISHED; ++ } + } + } + } diff --git a/SPECS/openslp.spec b/SPECS/openslp.spec index ff1b7b7..b36248d 100644 --- a/SPECS/openslp.spec +++ b/SPECS/openslp.spec @@ -1,6 +1,6 @@ Name: openslp Version: 2.0.0 -Release: 7%{?dist} +Release: 8%{?dist} Epoch: 1 Summary: Open implementation of Service Location Protocol V2 @@ -24,6 +24,9 @@ Patch1: openslp-2.0.0-fortify-source-buffer-overflow.patch # denial of service or potentially code execution, # backported form upstream, CVE-2017-17833 Patch2: openslp-2.0.0-cve-2017-17833.patch +# Patch3: fixes a heap-based buffer overflow vulnerability +# leading to remote code execution +Patch3: openslp-2.0.0-cve-2019-5544.patch BuildRequires: bison flex openssl-devel doxygen BuildRequires: automake libtool @@ -77,6 +80,7 @@ such applications. %patch0 -p1 -b .multicast-set %patch1 -p1 -b .fortify-source-buffer-overflow %patch2 -p1 -b .cve-2017-17833 +%patch3 -p1 -b .cve-2019-5544 %build @@ -157,9 +161,14 @@ rm -rf $RPM_BUILD_ROOT %changelog +* Tue Dec 10 2019 Vitezslav Crhonek - 1:2.0.0-8 +- Fix a heap-based buffer overflow vulnerability leading to + remote code execution, CVE-2019-5544 + Resolves: #1781701 + * Tue Jul 03 2018 Vitezslav Crhonek - 1:2.0.0-7 - Fix possible heap memory corruption, CVE-2017-17833 - Resolves: #1575698 + Resolves: #1597725 * Tue Jun 28 2016 Vitezslav Crhonek - 1:2.0.0-6 - Fix buffer overflow termination of slpd with -D_FORTIFY_SOURCE=2