[Buildroot] [PATCH 1/2] package/connman: fix CVE-2023-28488

[Clement Ramirez <ramirez.clement3@gmail.com>]

client.c in gdhcp in ConnMan through 1.41 could be used by
network-adjacent attackers (operating a crafted DHCP server) to cause a
stack-based buffer overflow and denial of service, terminating the
connman process.n process. (see [0] and [1] for details)

[0] https://nvd.nist.gov/vuln/detail/CVE-2023-28488
[1] https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=99e2c16ea1cced34a5dc450d76287a1c3e762138

Signed-off-by: Clement Ramirez <ramirez.clement3@gmail.com>
---
 .checkpackageignore                           |  1 +
 ...ify-and-sanitize-packet-length-first.patch | 62 +++++++++++++++++++
 package/connman/connman.mk                    |  3 +
 3 files changed, 66 insertions(+)
 create mode 100644 package/connman/0004-gdhcp-Verify-and-sanitize-packet-length-first.patch

diff --git a/.checkpackageignore b/.checkpackageignore
index dfc1ba9001..54525e5d90 100644
--- a/.checkpackageignore
+++ b/.checkpackageignore
@@ -266,6 +266,7 @@ package/collectd/0001-src-netlink.c-remove-REG_NOERROR.patch Upstream
 package/connman/0001-gweb-Fix-OOB-write-in-received_data.patch Upstream
 package/connman/0002-wispr-Add-reference-counter-to-portal-context.patch Upstream
 package/connman/0003-wispr-Update-portal-context-references.patch Upstream
+package/connman/0004-gdhcp-Verify-and-sanitize-packet-length-first.patch Upstream
 package/connman/S45connman Variables
 package/copas/0001-Do-not-load-coxpcall-for-LuaJIT.patch Upstream
 package/coremark-pro/coremark-pro.sh.in Shellcheck
diff --git a/package/connman/0004-gdhcp-Verify-and-sanitize-packet-length-first.patch b/package/connman/0004-gdhcp-Verify-and-sanitize-packet-length-first.patch
new file mode 100644
index 0000000000..d5d81f17bf
--- /dev/null
+++ b/package/connman/0004-gdhcp-Verify-and-sanitize-packet-length-first.patch
@@ -0,0 +1,62 @@
+From 996d39df6f6c0f9d1e9968af8024bb0cde31d1e8 Mon Sep 17 00:00:00 2001
+From: Daniel Wagner <wagi@monom.org>
+Date: Tue, 11 Apr 2023 08:12:56 +0200
+Subject: gdhcp: Verify and sanitize packet length first
+
+Avoid overwriting the read packet length after the initial test. Thus
+move all the length checks which depends on the total length first
+and do not use the total lenght from the IP packet afterwards.
+
+Fixes CVE-2023-28488
+
+Reported by Polina Smirnova <moe.hwr@gmail.com>
+
+[Retrieved from:
+https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=99e2c16ea1cced34a5dc450d76287a1c3e762138]
+Signed-off-by: Clement Ramirez <ramirez.clement3@gmail.com>
+---
+ gdhcp/client.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/gdhcp/client.c b/gdhcp/client.c
+index 3016dfc2..28fa6066 100644
+--- a/gdhcp/client.c
++++ b/gdhcp/client.c
+@@ -1319,9 +1319,9 @@ static bool sanity_check(struct ip_udp_dhcp_packet *packet, int bytes)
+ static int dhcp_recv_l2_packet(struct dhcp_packet *dhcp_pkt, int fd,
+ 				struct sockaddr_in *dst_addr)
+ {
+-	int bytes;
+ 	struct ip_udp_dhcp_packet packet;
+ 	uint16_t check;
++	int bytes, tot_len;
+ 
+ 	memset(&packet, 0, sizeof(packet));
+ 
+@@ -1329,15 +1329,17 @@ static int dhcp_recv_l2_packet(struct dhcp_packet *dhcp_pkt, int fd,
+ 	if (bytes < 0)
+ 		return -1;
+ 
+-	if (bytes < (int) (sizeof(packet.ip) + sizeof(packet.udp)))
+-		return -1;
+-
+-	if (bytes < ntohs(packet.ip.tot_len))
++	tot_len = ntohs(packet.ip.tot_len);
++	if (bytes > tot_len) {
++		/* ignore any extra garbage bytes */
++		bytes = tot_len;
++	} else if (bytes < tot_len) {
+ 		/* packet is bigger than sizeof(packet), we did partial read */
+ 		return -1;
++	}
+ 
+-	/* ignore any extra garbage bytes */
+-	bytes = ntohs(packet.ip.tot_len);
++	if (bytes < (int) (sizeof(packet.ip) + sizeof(packet.udp)))
++		return -1;
+ 
+ 	if (!sanity_check(&packet, bytes))
+ 		return -1;
+-- 
+2.34.1
+
diff --git a/package/connman/connman.mk b/package/connman/connman.mk
index fbd7318e4e..40ce99fa40 100644
--- a/package/connman/connman.mk
+++ b/package/connman/connman.mk
@@ -20,6 +20,9 @@ CONNMAN_IGNORE_CVES += CVE-2022-32292
 # 0003-wispr-Update-portal-context-references.patch
 CONNMAN_IGNORE_CVES += CVE-2022-32293
 
+# 0004-gdhcp-Verify-and-sanitize-packet-length-first.patch
+CONNMAN_IGNORE_CVES += CVE-2023-28488
+
 CONNMAN_CONF_OPTS = --with-dbusconfdir=/etc
 
 ifeq ($(BR2_INIT_SYSTEMD),y)
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot