Pi-Hole/dnsmasq
1
0
Fork 0
mirror of https://github.com/pi-hole/dnsmasq.git synced 2025-12-19 10:18:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix write-after-free error in DHCPv6 code. CVE-2022-0934 refers.

Browse Source
This commit is contained in:
Simon Kelley
2022-03-31 21:35:20 +01:00
parent 191924576c
commit 03345ecefe
2 changed files with 30 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGELOG
View File

@@ -55,6 +55,9 @@ version 2.87
doesn't require hard-coding addresses. Thanks to Sten Spans for doesn't require hard-coding addresses. Thanks to Sten Spans for
the idea. the idea.
Fix write-after-free error in DHCPv6 server code.
CVE-2022-0934 refers.
version 2.86 version 2.86
Handle DHCPREBIND requests in the DHCPv6 server code. Handle DHCPREBIND requests in the DHCPv6 server code.

48
src/rfc3315.c
View File

@@ -33,9 +33,9 @@ struct state {
unsigned int mac_len, mac_type; unsigned int mac_len, mac_type;
}; };
static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz, static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz,
struct in6_addr *client_addr, int is_unicast, time_t now); struct in6_addr *client_addr, int is_unicast, time_t now);
static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now); static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now);
static void log6_opts(int nest, unsigned int xid, void *start_opts, void *end_opts); static void log6_opts(int nest, unsigned int xid, void *start_opts, void *end_opts);
static void log6_packet(struct state *state, char *type, struct in6_addr *addr, char *string); static void log6_packet(struct state *state, char *type, struct in6_addr *addr, char *string);
static void log6_quiet(struct state *state, char *type, struct in6_addr *addr, char *string); static void log6_quiet(struct state *state, char *type, struct in6_addr *addr, char *string);
@@ -104,12 +104,12 @@ unsigned short dhcp6_reply(struct dhcp_context *context, int interface, char *if
} }
/* This cost me blood to write, it will probably cost you blood to understand - srk. */ /* This cost me blood to write, it will probably cost you blood to understand - srk. */
static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz, static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz,
struct in6_addr *client_addr, int is_unicast, time_t now) struct in6_addr *client_addr, int is_unicast, time_t now)
{ {
void *end = inbuff + sz; void *end = inbuff + sz;
void *opts = inbuff + 34; void *opts = inbuff + 34;
int msg_type = *((unsigned char *)inbuff); int msg_type = *inbuff;
unsigned char *outmsgtypep; unsigned char *outmsgtypep;
void *opt; void *opt;
struct dhcp_vendor *vendor; struct dhcp_vendor *vendor;
@@ -259,15 +259,15 @@ static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,
return 1; return 1;
} }
static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now) static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now)
{ {
void *opt; void *opt;
int i, o, o1, start_opts; int i, o, o1, start_opts, start_msg;
struct dhcp_opt *opt_cfg; struct dhcp_opt *opt_cfg;
struct dhcp_netid *tagif; struct dhcp_netid *tagif;
struct dhcp_config *config = NULL; struct dhcp_config *config = NULL;
struct dhcp_netid known_id, iface_id, v6_id; struct dhcp_netid known_id, iface_id, v6_id;
unsigned char *outmsgtypep; unsigned char outmsgtype;
struct dhcp_vendor *vendor; struct dhcp_vendor *vendor;
struct dhcp_context *context_tmp; struct dhcp_context *context_tmp;
struct dhcp_mac *mac_opt; struct dhcp_mac *mac_opt;
@@ -296,12 +296,13 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
v6_id.next = state->tags; v6_id.next = state->tags;
state->tags = &v6_id; state->tags = &v6_id;
/* copy over transaction-id, and save pointer to message type */ start_msg = save_counter(-1);
if (!(outmsgtypep = put_opt6(inbuff, 4))) /* copy over transaction-id */
if (!put_opt6(inbuff, 4))
return 0; return 0;
start_opts = save_counter(-1); start_opts = save_counter(-1);
state->xid = outmsgtypep[3] | outmsgtypep[2] << 8 | outmsgtypep[1] << 16; state->xid = inbuff[3] | inbuff[2] << 8 | inbuff[1] << 16;
/* We're going to be linking tags from all context we use. /* We're going to be linking tags from all context we use.
mark them as unused so we don't link one twice and break the list */ mark them as unused so we don't link one twice and break the list */
for (context_tmp = state->context; context_tmp; context_tmp = context_tmp->current) for (context_tmp = state->context; context_tmp; context_tmp = context_tmp->current)
@@ -347,7 +348,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
(msg_type == DHCP6REQUEST || msg_type == DHCP6RENEW || msg_type == DHCP6RELEASE || msg_type == DHCP6DECLINE)) (msg_type == DHCP6REQUEST || msg_type == DHCP6RENEW || msg_type == DHCP6RELEASE || msg_type == DHCP6DECLINE))
{ {
*outmsgtypep = DHCP6REPLY; outmsgtype = DHCP6REPLY;
o1 = new_opt6(OPTION6_STATUS_CODE); o1 = new_opt6(OPTION6_STATUS_CODE);
put_opt6_short(DHCP6USEMULTI); put_opt6_short(DHCP6USEMULTI);
put_opt6_string("Use multicast"); put_opt6_string("Use multicast");
@@ -619,11 +620,11 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
struct dhcp_netid *solicit_tags; struct dhcp_netid *solicit_tags;
struct dhcp_context *c; struct dhcp_context *c;
*outmsgtypep = DHCP6ADVERTISE; outmsgtype = DHCP6ADVERTISE;
if (opt6_find(state->packet_options, state->end, OPTION6_RAPID_COMMIT, 0)) if (opt6_find(state->packet_options, state->end, OPTION6_RAPID_COMMIT, 0))
{ {
*outmsgtypep = DHCP6REPLY; outmsgtype = DHCP6REPLY;
state->lease_allocate = 1; state->lease_allocate = 1;
o = new_opt6(OPTION6_RAPID_COMMIT); o = new_opt6(OPTION6_RAPID_COMMIT);
end_opt6(o); end_opt6(o);
@@ -809,7 +810,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
int start = save_counter(-1); int start = save_counter(-1);
/* set reply message type */ /* set reply message type */
*outmsgtypep = DHCP6REPLY; outmsgtype = DHCP6REPLY;
state->lease_allocate = 1; state->lease_allocate = 1;
log6_quiet(state, "DHCPREQUEST", NULL, ignore ? _("ignored") : NULL); log6_quiet(state, "DHCPREQUEST", NULL, ignore ? _("ignored") : NULL);
@@ -924,7 +925,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
int address_assigned = 0; int address_assigned = 0;
/* set reply message type */ /* set reply message type */
*outmsgtypep = DHCP6REPLY; outmsgtype = DHCP6REPLY;
log6_quiet(state, msg_type == DHCP6RENEW ? "DHCPRENEW" : "DHCPREBIND", NULL, NULL); log6_quiet(state, msg_type == DHCP6RENEW ? "DHCPRENEW" : "DHCPREBIND", NULL, NULL);
@@ -1057,7 +1058,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
int good_addr = 0; int good_addr = 0;
/* set reply message type */ /* set reply message type */
*outmsgtypep = DHCP6REPLY; outmsgtype = DHCP6REPLY;
log6_quiet(state, "DHCPCONFIRM", NULL, NULL); log6_quiet(state, "DHCPCONFIRM", NULL, NULL);
@@ -1121,7 +1122,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
log6_quiet(state, "DHCPINFORMATION-REQUEST", NULL, ignore ? _("ignored") : state->hostname); log6_quiet(state, "DHCPINFORMATION-REQUEST", NULL, ignore ? _("ignored") : state->hostname);
if (ignore) if (ignore)
return 0; return 0;
*outmsgtypep = DHCP6REPLY; outmsgtype = DHCP6REPLY;
tagif = add_options(state, 1); tagif = add_options(state, 1);
break; break;
} }
@@ -1130,7 +1131,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
case DHCP6RELEASE: case DHCP6RELEASE:
{ {
/* set reply message type */ /* set reply message type */
*outmsgtypep = DHCP6REPLY; outmsgtype = DHCP6REPLY;
log6_quiet(state, "DHCPRELEASE", NULL, NULL); log6_quiet(state, "DHCPRELEASE", NULL, NULL);
@@ -1195,7 +1196,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
case DHCP6DECLINE: case DHCP6DECLINE:
{ {
/* set reply message type */ /* set reply message type */
*outmsgtypep = DHCP6REPLY; outmsgtype = DHCP6REPLY;
log6_quiet(state, "DHCPDECLINE", NULL, NULL); log6_quiet(state, "DHCPDECLINE", NULL, NULL);
@@ -1275,7 +1276,12 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
} }
} }
/* Fill in the message type. Note that we store the offset,
not a direct pointer, since the packet memory may have been
reallocated. */
((unsigned char *)(daemon->outpacket.iov_base))[start_msg] = outmsgtype;
log_tags(tagif, state->xid); log_tags(tagif, state->xid);
log6_opts(0, state->xid, daemon->outpacket.iov_base + start_opts, daemon->outpacket.iov_base + save_counter(-1)); log6_opts(0, state->xid, daemon->outpacket.iov_base + start_opts, daemon->outpacket.iov_base + save_counter(-1));