Re: [PATCH] dnsproxy: Fix for CVE-2025-32366 in ConnMan dnsproxy.c

Hi Yunje,

On 4/10/25 4:11 PM, 신윤제(학부생-소프트웨어전공) wrote:
> Hello,
> 
> In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length
> that depends on an RR RDLENGTH value (i.e., *rdlen=ntohs(rr->rdlen)
> and memcpy(response+offset,*end,*rdlen)). Here, rdlen may be larger
> than the amount of remaining packet data in the current state of
> parsing. As a result, values of stack memory locations may be sent
> over the network in a response.
> 
> This patch adds a check to ensure that (*end + *rdlen) does not exceed
> the valid range. If the condition is violated, the function returns
> -EINVAL.
> 
> Patch diff snippet:
> 
> @@ -997,6 +997,9 @@
> 
>    if ((offset + *rdlen) > *response_size)
>    return -ENOBUFS;
> +
> + if ((*end + *rdlen) > max)
> +         return -EINVAL;
> 
>    memcpy(response + offset, *end, *rdlen);
> 
> Please review this patch and consider applying it to address the
> CVE-2025-32366 vulnerability.
> 
> Best regards,
> Yunje Shin
> Signed-off-by: Yunje Shin <[email protected]>
> 

Any chance you could send this as a proper patch using git send-email?

Regards,
-Denis