]> The Tcpdump Group git mirrors - tcpdump/commit
CVE-2017-13042/HNCP: add DHCPv6-Data bounds checks
authorDenis Ovsienko <[email protected]>
Sat, 29 Jul 2017 17:52:38 +0000 (18:52 +0100)
committerDenis Ovsienko <[email protected]>
Wed, 13 Sep 2017 11:25:44 +0000 (12:25 +0100)
commit39582c04cc5e34054b2936b423072fb9df2ff6ef
treefe9574ee05d00aa37b0ff7252abb0c04b6ddbab4
parentf4b9e24c7384d882a7f434cc7413925bf871d63e
CVE-2017-13042/HNCP: add DHCPv6-Data bounds checks

hncp_print_rec() validates each HNCP TLV to be within the declared as
well as the on-the-wire packet space. However, dhcpv6_print() in the same
file didn't do the same for the DHCPv6 options within the HNCP
DHCPv6-Data TLV value, which could cause an out-of-bounds read when
decoding an invalid packet. Add missing checks to dhcpv6_print().

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s).
print-hncp.c
tests/TESTLIST
tests/hncp_dhcpv6data-oobr.out [new file with mode: 0644]
tests/hncp_dhcpv6data-oobr.pcap [new file with mode: 0644]