CVE-2017-13025/IPv6 mobility: Add a bounds check before fetching data

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't cause 'tcpdump: pcap_loop: truncated dump file'

diff --git a/extract.h b/extract.h
index 04367546c6ed4f8913678408ab4229b9e09abc69..5969c22574b5a83cd9718c13ba7861da8d11e38d 100644 (file)
--- a/extract.h
+++ b/extract.h
@@ -281,3 +281,6 @@ EXTRACT_64BITS(const void *p)
 
 #define ND_TTEST_64BITS(p) ND_TTEST2(*(p), 8)
 #define ND_TCHECK_64BITS(p) ND_TCHECK2(*(p), 8)
+
+#define ND_TTEST_128BITS(p) ND_TTEST2(*(p), 16)
+#define ND_TCHECK_128BITS(p) ND_TCHECK2(*(p), 16)

diff --git a/print-mobility.c b/print-mobility.c
index 21a0fbade4894450e7063c95ada17bd7d49dcf71..44c9a77f4882bc82778fc466a927aee4c7bee936 100644 (file)
--- a/print-mobility.c
+++ b/print-mobility.c
@@ -159,6 +159,7 @@ mobility_opt_print(netdissect_options *ndo,
                                ND_PRINT((ndo, "(altcoa: trunc)"));
                                goto trunc;
                        }
+                       ND_TCHECK_128BITS(&bp[i+2]);
                        ND_PRINT((ndo, "(alt-CoA: %s)", ip6addr_string(ndo, &bp[i+2])));
                        break;
                case IP6MOPT_NONCEID:

diff --git a/tests/TESTLIST b/tests/TESTLIST
index e0caaa34b51b6aea21ed4f2592e7cceab5c82b35..2f3ab1ab51d4f6e91c6390a798c348dd3cdcd79f 100644 (file)
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -526,6 +526,7 @@ icmp6_mobileprefix_asan     icmp6_mobileprefix_asan.pcap    icmp6_mobileprefix_asan.out
 ip_printroute_asan     ip_printroute_asan.pcap         ip_printroute_asan.out  -v
 mobility_opt_asan      mobility_opt_asan.pcap          mobility_opt_asan.out   -v
 mobility_opt_asan_2    mobility_opt_asan_2.pcap        mobility_opt_asan_2.out -v
+mobility_opt_asan_3    mobility_opt_asan_3.pcap        mobility_opt_asan_3.out -v
 
 # RTP tests
 # fuzzed pcap

diff --git a/tests/mobility_opt_asan_3.out b/tests/mobility_opt_asan_3.out
new file mode 100644 (file)
index 0000000..7e2ce3a
--- /dev/null
+++ b/tests/mobility_opt_asan_3.out
@@ -0,0 +1,2 @@
+IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62) payload length: 7168) d400:7fa1:200:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: CoT nonce id=0x74 Care-of Init Cookie=80570f80:00000004[|MOBILITY]
+IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62) payload length: 7168) ffc3:b2a1:200:400::6238:2949 > 9675:86dd:73f0:2c:1c7f:ffff:ebc3:b2a1: mobility: BU seq#=39837 lifetime=261452[|MOBILITY]

diff --git a/tests/mobility_opt_asan_3.pcap b/tests/mobility_opt_asan_3.pcap
new file mode 100644 (file)
index 0000000..3926ac9
Binary files /dev/null and b/tests/mobility_opt_asan_3.pcap differ