From 1bca83a5d36c969c4e8c2c2343d592e57094903d Mon Sep 17 00:00:00 2001 From: Petr Menšík pemensik@redhat.com Date: Oct 02 2017 15:37:39 +0000 Subject: Security fix, CVE-2017-14493, DHCPv6 - Stack buffer overflow.
Fix stack overflow in DHCPv6 code. An attacker who can send a DHCPv6 request to dnsmasq can overflow the stack frame and crash or control dnsmasq.
Signed-off-by: Petr Menšík pemensik@redhat.com
---
diff --git a/dnsmasq-2.77-CVE-2017-14493.patch b/dnsmasq-2.77-CVE-2017-14493.patch new file mode 100644 index 0000000..d80553c --- /dev/null +++ b/dnsmasq-2.77-CVE-2017-14493.patch @@ -0,0 +1,30 @@ +From 3d4ff1ba8419546490b464418223132529514033 Mon Sep 17 00:00:00 2001 +From: Simon Kelley simon@thekelleys.org.uk +Date: Mon, 25 Sep 2017 18:52:50 +0100 +Subject: [PATCH 4/9] Security fix, CVE-2017-14493, DHCPv6 - Stack buffer + overflow. + +Fix stack overflow in DHCPv6 code. An attacker who can send +a DHCPv6 request to dnsmasq can overflow the stack frame and +crash or control dnsmasq. +--- + src/rfc3315.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/rfc3315.c b/src/rfc3315.c +index 1687931..920907c 100644 +--- a/src/rfc3315.c ++++ b/src/rfc3315.c +@@ -206,6 +206,9 @@ static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz, + /* RFC-6939 */ + if ((opt = opt6_find(opts, end, OPTION6_CLIENT_MAC, 3))) + { ++ if (opt6_len(opt) - 2 > DHCP_CHADDR_MAX) { ++ return 0; ++ } + state->mac_type = opt6_uint(opt, 0, 2); + state->mac_len = opt6_len(opt) - 2; + memcpy(&state->mac[0], opt6_ptr(opt, 2), state->mac_len); +-- +2.9.5 + diff --git a/dnsmasq.spec b/dnsmasq.spec index c6b7699..0e7246e 100644 --- a/dnsmasq.spec +++ b/dnsmasq.spec @@ -27,6 +27,7 @@ Source1: %{name}.service Patch0: dnsmasq-2.76-dns-sleep-resume.patch Patch2: dnsmasq-2.77-CVE-2017-14491.patch Patch3: dnsmasq-2.77-CVE-2017-14492.patch +Patch4: dnsmasq-2.77-CVE-2017-14493.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -64,6 +65,7 @@ query/remove a DHCP server's leases. %patch0 -p1 %patch2 -p1 -b .CVE-2017-14491 %patch3 -p1 -b .CVE-2017-14492 +%patch4 -p1 -b .CVE-2017-14493
# use /var/lib/dnsmasq instead of /var/lib/misc for file in dnsmasq.conf.example man/dnsmasq.8 man/es/dnsmasq.8 src/config.h; do @@ -152,8 +154,9 @@ rm -rf $RPM_BUILD_ROOT
%changelog * Mon Oct 02 2017 Petr Menšík pemensik@redhat.com - 2.76-4 -- Security fix, CVE-2017-14491 DNS heap buffer overflow -- Security fix, CVE-2017-14492 DHCPv6 RA heap overflow +- Security fix, CVE-2017-14491, DNS heap buffer overflow +- Security fix, CVE-2017-14492, DHCPv6 RA heap overflow +- Security fix, CVE-2017-14493, DHCPv6 - Stack buffer overflow
* Fri Feb 10 2017 Fedora Release Engineering releng@fedoraproject.org - 2.76-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
https://src.fedoraproject.org/rpms/dnsmasq/c/1bca83a5d36c969c4e8c2c2343d592e...