diff --git a/SOURCES/0085-Prevent-possible-DoS-attempts-during-protocol-handsh.patch b/SOURCES/0085-Prevent-possible-DoS-attempts-during-protocol-handsh.patch new file mode 100644 index 0000000..38c9db7 --- /dev/null +++ b/SOURCES/0085-Prevent-possible-DoS-attempts-during-protocol-handsh.patch @@ -0,0 +1,57 @@ +From 198ad1ea078c1b74c9e24617c509c6a408eb822e Mon Sep 17 00:00:00 2001 +From: Frediano Ziglio +Date: Mon, 28 Nov 2016 13:15:58 +0000 +Subject: [PATCH] Prevent possible DoS attempts during protocol handshake + +The limit for link message is specified using a 32 bit unsigned integer. +This could cause possible DoS due to excessive memory allocations and +some possible crashes. +For instance a value >= 2^31 causes a spice_assert to be triggered in +async_read_handler (reds-stream.c) due to an integer overflow at this +line: + + int n = async->end - async->now; + +This could be easily triggered with a program like + + #!/usr/bin/env python + + import socket + import time + from struct import pack + + server = '127.0.0.1' + port = 5900 + + s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + s.connect((server, port)) + data = pack('<4sIII', 'REDQ', 2, 2, 0xaaaaaaaa) + s.send(data) + + time.sleep(1) + +without requiring any authentication (the same can be done +with TLS). + +Signed-off-by: Frediano Ziglio +--- + server/reds.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/server/reds.c b/server/reds.c +index 9e1d5e7..1c215ed 100644 +--- a/server/reds.c ++++ b/server/reds.c +@@ -2826,7 +2826,8 @@ static void reds_handle_read_header_done(void *opaque) + + reds->peer_minor_version = header->minor_version; + +- if (header->size < sizeof(SpiceLinkMess)) { ++ /* the check for 4096 is to avoid clients to cause arbitrary big memory allocations */ ++ if (header->size < sizeof(SpiceLinkMess) || header->size > 4096) { + reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA); + spice_warning("bad size %u", header->size); + reds_link_free(link); +-- +2.9.3 + diff --git a/SOURCES/0086-Prevent-integer-overflows-in-capability-checks.patch b/SOURCES/0086-Prevent-integer-overflows-in-capability-checks.patch new file mode 100644 index 0000000..83c914d --- /dev/null +++ b/SOURCES/0086-Prevent-integer-overflows-in-capability-checks.patch @@ -0,0 +1,40 @@ +From 665f7dddd2d534500d3b3e3e1f8135c49479ad25 Mon Sep 17 00:00:00 2001 +From: Frediano Ziglio +Date: Mon, 28 Nov 2016 13:15:58 +0000 +Subject: [PATCH] Prevent integer overflows in capability checks + +The limits for capabilities are specified using 32 bit unsigned integers. +This could cause possible integer overflows causing buffer overflows. +For instance the sum of num_common_caps and num_caps can be 0 avoiding +additional checks. +As the link message is now capped to 4096 and the capabilities are +contained in the link message, this commit limits the capabilities +to 1024 (capabilities are expressed in number of uint32_t items). + +Signed-off-by: Frediano Ziglio +--- + server/reds.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/server/reds.c b/server/reds.c +index 64f07cc..f5542f6 100644 +--- a/server/reds.c ++++ b/server/reds.c +@@ -2744,6 +2744,14 @@ static void reds_handle_read_link_done(void *opaque) + uint32_t num_caps = link_mess->num_common_caps + link_mess->num_channel_caps; + int auth_selection; + ++ /* Prevent integer overflows. Currently we defined only 13 capabilities, ++ * I expect 1024 to be valid for quite a lot time */ ++ if (link_mess->num_channel_caps > 1024 || link_mess->num_common_caps > 1024) { ++ reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA); ++ reds_link_free(link); ++ return; ++ } ++ + if (num_caps && (num_caps * sizeof(uint32_t) + link_mess->caps_offset > + link->link_header.size || + link_mess->caps_offset < sizeof(*link_mess))) { +-- +2.9.3 + diff --git a/SOURCES/0087-main-channel-Prevent-overflow-reading-messages-from-.patch b/SOURCES/0087-main-channel-Prevent-overflow-reading-messages-from-.patch new file mode 100644 index 0000000..a61dd04 --- /dev/null +++ b/SOURCES/0087-main-channel-Prevent-overflow-reading-messages-from-.patch @@ -0,0 +1,30 @@ +From c4e3113a8df53ba60c36829c8b2d583c2d5e529d Mon Sep 17 00:00:00 2001 +From: Frediano Ziglio +Date: Tue, 29 Nov 2016 16:46:56 +0000 +Subject: [PATCH] main-channel: Prevent overflow reading messages from client + +Caller is supposed the function return a buffer able to store +size bytes. + +Signed-off-by: Frediano Ziglio +--- + server/main_channel.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/server/main_channel.c b/server/main_channel.c +index 54718ba..bedff46 100644 +--- a/server/main_channel.c ++++ b/server/main_channel.c +@@ -1030,6 +1030,9 @@ static uint8_t *main_channel_alloc_msg_rcv_buf(RedChannelClient *rcc, + + if (type == SPICE_MSGC_MAIN_AGENT_DATA) { + return reds_get_agent_data_buffer(mcc, size); ++ } else if (size > sizeof(main_chan->recv_buf)) { ++ /* message too large, caller will log a message and close the connection */ ++ return NULL; + } else { + return main_chan->recv_buf; + } +-- +2.9.3 + diff --git a/SPECS/spice.spec b/SPECS/spice.spec index 88a3616..86854af 100644 --- a/SPECS/spice.spec +++ b/SPECS/spice.spec @@ -1,6 +1,6 @@ Name: spice Version: 0.12.4 -Release: 19%{?dist} +Release: 20%{?dist} Summary: Implements the SPICE protocol Group: User Interface/Desktops License: LGPLv2+ @@ -90,6 +90,9 @@ Patch81: 0081-sound-do-not-modify-client-state-on-migration.patch Patch82: 0082-char-device-spice_char_device_write_to_device-protec.patch Patch83: 0083-server-allows-to-set-maximum-monitors.patch Patch84: 0084-Call-migrate_end_complete-after-falling-back-to-swit.patch +Patch85: 0085-Prevent-possible-DoS-attempts-during-protocol-handsh.patch +Patch86: 0086-Prevent-integer-overflows-in-capability-checks.patch +Patch87: 0087-main-channel-Prevent-overflow-reading-messages-from-.patch # https://bugzilla.redhat.com/show_bug.cgi?id=613529 @@ -177,6 +180,12 @@ mkdir -p %{buildroot}%{_libexecdir} %changelog +* Fri Dec 09 2016 Frediano Ziglio - 0.12.4-20 +- Fix buffer overflow in main_channel_alloc_msg_rcv_buf when reading large + messages. + Resolves: CVE-2016-9577 +- Fix remote DoS via crafted message. + Resolves: CVE-2016-9578 * Fri Sep 09 2016 Christophe Fergeau 0.12.4-19 - Ensure SPICE_MIGRATE_COMPLETED is sent in all cases when it's needed. Resolves: rhbz#1352836