[PATCH] udhcpc6: reject packets with too-short UDP length
Ali Ahmet Memis via busybox <[email protected]>
| Newsgroups | gmane.linux.busybox |
|---|---|
| Message-ID | <[email protected]> |
d6_recv_raw_packet() derives the packet length from the IPv6 payload length field and then subtracts sizeof(ip6)+sizeof(udp) before the final memcpy() into the caller's buffer. The sanity check only ensured that udp.len equals ip6_plen, not that it is at least the UDP header size. An on-link attacker can send an IPv6/UDP frame whose payload-length field is below 8; the subtraction then underflows and memcpy() is called with a huge (negative, cast to size_t) length, crashing the client. Reject packets whose UDP length field is smaller than the UDP header. Signed-off-by: Ali Ahmet Memis <[email protected]> --- networking/udhcp/d6_dhcpc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/networking/udhcp/d6_dhcpc.c b/networking/udhcp/d6_dhcpc.c index ab3994250..b28f73f3c 100644 --- a/networking/udhcp/d6_dhcpc.c +++ b/networking/udhcp/d6_dhcpc.c @@ -1041,6 +1041,7 @@ static NOINLINE int d6_recv_raw_packet(struct in6_addr *peer_ipv6, struct d6_pac || packet.udp.dest != htons(CLIENT_PORT6) /* || bytes > (int) sizeof(packet) - can't happen */ || packet.udp.len != packet.ip6.ip6_plen + || ntohs(packet.udp.len) < sizeof(packet.udp) /* else bytes underflows below */ ) { log1s("unrelated/bogus packet, ignoring"); return -2; -- 2.55.0