NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package/lldpd: fix CVE-2023-41910

Browse Source 
An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU
packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can
remotely force the lldpd daemon to perform an out-of-bounds read on heap
memory. This occurs in cdp_decode in daemon/protocols/cdp.c.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This commit is contained in:
Fabrice Fontaine 2023-09-14 23:18:39 +02:00 committed by Thomas Petazzoni
parent 23e774d2de
commit 3557a7b599
2 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
package/lldpd/0001-daemon-fix-read-overflow-when-parsing-CDP-addresses.patch Normal file
View File

@ -0,0 +1,24 @@
From a9aeabdf879c25c584852a0bb5523837632f099b Mon Sep 17 00:00:00 2001
From: Vincent Bernat <vincent@bernat.ch>
Date: Wed, 12 Apr 2023 07:38:31 +0200
Subject: [PATCH] daemon: fix read overflow when parsing CDP addresses
Upstream: https://github.com/lldpd/lldpd/commit/a9aeabdf879c25c584852a0bb5523837632f099b
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
NEWS | 4 ++++
src/daemon/protocols/cdp.c | 1 +
2 files changed, 5 insertions(+)
diff --git a/src/daemon/protocols/cdp.c b/src/daemon/protocols/cdp.c
index 8a1be863..42861c0e 100644
--- a/src/daemon/protocols/cdp.c
+++ b/src/daemon/protocols/cdp.c
@@ -466,6 +466,7 @@ cdp_decode(struct lldpd *cfg, char *frame, int s, struct lldpd_hardware *hardwar
goto malformed;
}
PEEK_DISCARD(address_len);
+ addresses_len -= address_len;
(void)PEEK_SAVE(pos_next_address);
/* Next, we go back and try to extract
IPv4 address */

3
package/lldpd/lldpd.mk
View File

@ -16,6 +16,9 @@ LLDPD_LICENSE = ISC
LLDPD_LICENSE_FILES = LICENSE
LLDPD_CPE_ID_VENDOR = lldpd_project
# 0001-daemon-fix-read-overflow-when-parsing-CDP-addresses.patch
LLDPD_IGNORE_CVES += CVE-2023-41910
# Detection of c99 support in configure fails without WCHAR. To enable
# automatic detection of c99 support by configure, we need to enable
# WCHAR in toolchain. But actually we do not need WCHAR at lldpd