From: Gert Doering Date: Tue, 13 Jun 2017 20:08:32 +0000 (+0200) Subject: Fix remotely-triggerable ASSERT() on malformed IPv6 packet. X-Git-Tag: v2.4.3~1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ed28cde3d8bf3f1459b2f42f0e27d64801009f92;p=thirdparty%2Fopenvpn.git Fix remotely-triggerable ASSERT() on malformed IPv6 packet. Correct sanity checks on IPv6 packet length in mss_fixup_ipv6(), and change the ASSERT() check in mss_fixup_dowork() into a simple "return" (= the TCP header will simply not be inspected further). CVE-2017-7508 has been assigned due to the serious nature of the bug: it can be used to remotely shutdown an openvpn server or client, if IPv6 and --mssfix are enabled and the IPv6 networks used inside the VPN are known. Found by Guido Vranken . v2: style changes CVE: 2017-7508 Signed-off-by: Gert Doering Acked-by: Steffan Karger Message-Id: <20170613200832.15027-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/search?l=mid&q=20170613200832.15027-1-gert@greenie.muc.de Signed-off-by: Gert Doering (cherry picked from commit c3f47077a7756de5929094569421a95aa66f2022) --- diff --git a/src/openvpn/mss.c b/src/openvpn/mss.c index 7c596d781..c36e00464 100644 --- a/src/openvpn/mss.c +++ b/src/openvpn/mss.c @@ -119,8 +119,12 @@ mss_fixup_ipv6(struct buffer *buf, int maxmss) return; } + /* skip IPv6 header (40 bytes), + * verify remainder is large enough to contain a full TCP header + */ newbuf = *buf; - if (buf_advance( &newbuf, 40 ) ) + if (buf_advance( &newbuf, 40 ) + && BLEN(&newbuf) >= (int) sizeof(struct openvpn_tcphdr)) { struct openvpn_tcphdr *tc = (struct openvpn_tcphdr *) BPTR(&newbuf); if (tc->flags & OPENVPN_TCPH_SYN_MASK) @@ -144,7 +148,10 @@ mss_fixup_dowork(struct buffer *buf, uint16_t maxmss) int accumulate; struct openvpn_tcphdr *tc; - ASSERT(BLEN(buf) >= (int) sizeof(struct openvpn_tcphdr)); + if (BLEN(buf) < (int) sizeof(struct openvpn_tcphdr)) + { + return; + } verify_align_4(buf); tc = (struct openvpn_tcphdr *) BPTR(buf);