Correct sanity checks on IPv6 packet length in mss_fixup_ipv6(),
and change the ASSERT() check in mss_fixup_dowork() into a simple
"return" (= the TCP header will simply not be inspected further).
CVE-2017-7508 has been assigned due to the serious nature of the
bug: it can be used to remotely shutdown an openvpn server or
client, if IPv6 and --mssfix are enabled and the IPv6 networks used
inside the VPN are known.
Found by Guido Vranken <guidovran...@gmail.com>.
v2: style changes
Signed-off-by: Gert Doering <g...@greenie.muc.de>
---
src/openvpn/mss.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/src/openvpn/mss.c b/src/openvpn/mss.c
index 51e1ae0..e451350 100644
--- a/src/openvpn/mss.c
+++ b/src/openvpn/mss.c
@@ -120,8 +120,12 @@ mss_fixup_ipv6(struct buffer *buf, int maxmss)
return;
}
+ /* skip IPv6 header (40 bytes),
+ * verify remainder is large enough to contain a full TCP header
+ */
newbuf = *buf;
- if (buf_advance( &newbuf, 40 ) )
+ if (buf_advance( &newbuf, 40 )
+ && BLEN(&newbuf) >= (int) sizeof(struct openvpn_tcphdr))
{
struct openvpn_tcphdr *tc = (struct openvpn_tcphdr *) BPTR(&newbuf);
if (tc->flags & OPENVPN_TCPH_SYN_MASK)
@@ -145,7 +149,10 @@ mss_fixup_dowork(struct buffer *buf, uint16_t maxmss)
int accumulate;
struct openvpn_tcphdr *tc;
- ASSERT(BLEN(buf) >= (int) sizeof(struct openvpn_tcphdr));
+ if (BLEN(buf) < (int) sizeof(struct openvpn_tcphdr))
+ {
+ return;
+ }
verify_align_4(buf);
tc = (struct openvpn_tcphdr *) BPTR(buf);
--
2.10.2
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Openvpn-devel mailing list
Openvpn-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
