Module Name: src
Committed By: martin
Date: Wed May 4 14:30:04 UTC 2022
Modified Files:
src/sys/net: if_pppoe.c
Log Message:
Do not allocate mbuf clusters when the caller (eroneously) asks
for more than MCLBYTES size, instead fail the allocation.
When we have received multiple PADO offer packets in the discovery
phase, do not combine tags from different packets. We are supposed
to pick one PADO packet and continue session establishment with that.
The second bug could cause code to trigger the first and create
invalid response packets and also overwrite data outside of
the allocated mbuf cluster.
Fixes CVE-2022-29867.
To generate a diff of this commit:
cvs rdiff -u -r1.178 -r1.179 src/sys/net/if_pppoe.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/net/if_pppoe.c
diff -u src/sys/net/if_pppoe.c:1.178 src/sys/net/if_pppoe.c:1.179
--- src/sys/net/if_pppoe.c:1.178 Mon Oct 11 05:13:11 2021
+++ src/sys/net/if_pppoe.c Wed May 4 14:30:04 2022
@@ -1,4 +1,4 @@
-/* $NetBSD: if_pppoe.c,v 1.178 2021/10/11 05:13:11 knakahara Exp $ */
+/* $NetBSD: if_pppoe.c,v 1.179 2022/05/04 14:30:04 martin Exp $ */
/*
* Copyright (c) 2002, 2008 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.178 2021/10/11 05:13:11 knakahara Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.179 2022/05/04 14:30:04 martin Exp $");
#ifdef _KERNEL_OPT
#include "pppoe.h"
@@ -958,6 +958,10 @@ breakbreak:;
}
sc->sc_ac_cookie_len = ac_cookie_len;
memcpy(sc->sc_ac_cookie, ac_cookie, ac_cookie_len);
+ } else if (sc->sc_ac_cookie) {
+ free(sc->sc_ac_cookie, M_DEVBUF);
+ sc->sc_ac_cookie = NULL;
+ sc->sc_ac_cookie_len = 0;
}
if (relay_sid) {
if (sc->sc_relay_sid)
@@ -972,6 +976,10 @@ breakbreak:;
}
sc->sc_relay_sid_len = relay_sid_len;
memcpy(sc->sc_relay_sid, relay_sid, relay_sid_len);
+ } else if (sc->sc_relay_sid) {
+ free(sc->sc_relay_sid, M_DEVBUF);
+ sc->sc_relay_sid = NULL;
+ sc->sc_relay_sid_len = 0;
}
memcpy(&sc->sc_dest, eh->ether_shost, sizeof sc->sc_dest);
callout_stop(&sc->sc_timeout);
@@ -1418,6 +1426,9 @@ pppoe_get_mbuf(size_t len)
{
struct mbuf *m;
+ if (len + sizeof(struct ether_header) > MCLBYTES)
+ return NULL;
+
MGETHDR(m, M_DONTWAIT, MT_DATA);
if (m == NULL)
return NULL;
