Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package dnsmasq for openSUSE:Factory checked in at 2022-04-14 17:23:28 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/dnsmasq (Old) and /work/SRC/openSUSE:Factory/.dnsmasq.new.1941 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "dnsmasq" Thu Apr 14 17:23:28 2022 rev:86 rq:969348 version:2.86 Changes: -------- --- /work/SRC/openSUSE:Factory/dnsmasq/dnsmasq.changes 2021-11-27 00:51:39.494732900 +0100 +++ /work/SRC/openSUSE:Factory/.dnsmasq.new.1941/dnsmasq.changes 2022-04-14 17:23:35.587132085 +0200 @@ -1,0 +2,6 @@ +Tue Apr 5 07:16:18 UTC 2022 - Reinhard Max <[email protected]> + +- bsc#1197872, CVE-2022-0934, dnsmasq-CVE-2022-0934.patch: + Heap use after free in dhcp6_no_relay + +------------------------------------------------------------------- New: ---- dnsmasq-CVE-2022-0934.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ dnsmasq.spec ++++++ --- /var/tmp/diff_new_pack.zRajYK/_old 2022-04-14 17:23:36.179132777 +0200 +++ /var/tmp/diff_new_pack.zRajYK/_new 2022-04-14 17:23:36.187132786 +0200 @@ -1,7 +1,7 @@ # # spec file for package dnsmasq # -# Copyright (c) 2021 SUSE LLC +# Copyright (c) 2022 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -38,6 +38,7 @@ Source8: %{name}-rpmlintrc Patch0: dnsmasq-groups.patch Patch1: dnsmasq-resolv-conf.patch +Patch2: dnsmasq-CVE-2022-0934.patch BuildRequires: dbus-1-devel BuildRequires: dos2unix BuildRequires: libidn2-devel @@ -77,6 +78,7 @@ %setup -q %patch0 %patch1 +%patch2 # Remove the executable bit from python example files to # avoid unwanted automatic dependencies ++++++ dnsmasq-CVE-2022-0934.patch ++++++ >From 03345ecefeb0d82e3c3a4c28f27c3554f0611b39 Mon Sep 17 00:00:00 2001 From: Simon Kelley <[email protected]> Date: Thu, 31 Mar 2022 21:35:20 +0100 Subject: [PATCH] Fix write-after-free error in DHCPv6 code. CVE-2022-0934 refers. --- CHANGELOG | 3 +++ src/rfc3315.c | 48 +++++++++++++++++++++++++++--------------------- 2 files changed, 30 insertions(+), 21 deletions(-) --- CHANGELOG.orig +++ CHANGELOG @@ -1,3 +1,8 @@ + + Fix write-after-free error in DHCPv6 server code. + CVE-2022-0934 refers. + + version 2.86 Handle DHCPREBIND requests in the DHCPv6 server code. Thanks to Aichun Li for spotting this omission, and the initial --- src/rfc3315.c.orig +++ src/rfc3315.c @@ -33,9 +33,9 @@ struct state { unsigned int mac_len, mac_type; }; -static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz, +static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz, struct in6_addr *client_addr, int is_unicast, time_t now); -static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now); +static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now); static void log6_opts(int nest, unsigned int xid, void *start_opts, void *end_opts); static void log6_packet(struct state *state, char *type, struct in6_addr *addr, char *string); static void log6_quiet(struct state *state, char *type, struct in6_addr *addr, char *string); @@ -104,12 +104,12 @@ unsigned short dhcp6_reply(struct dhcp_c } /* This cost me blood to write, it will probably cost you blood to understand - srk. */ -static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz, +static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz, struct in6_addr *client_addr, int is_unicast, time_t now) { void *end = inbuff + sz; void *opts = inbuff + 34; - int msg_type = *((unsigned char *)inbuff); + int msg_type = *inbuff; unsigned char *outmsgtypep; void *opt; struct dhcp_vendor *vendor; @@ -259,15 +259,15 @@ static int dhcp6_maybe_relay(struct stat return 1; } -static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now) +static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now) { void *opt; - int i, o, o1, start_opts; + int i, o, o1, start_opts, start_msg; struct dhcp_opt *opt_cfg; struct dhcp_netid *tagif; struct dhcp_config *config = NULL; struct dhcp_netid known_id, iface_id, v6_id; - unsigned char *outmsgtypep; + unsigned char outmsgtype; struct dhcp_vendor *vendor; struct dhcp_context *context_tmp; struct dhcp_mac *mac_opt; @@ -296,12 +296,13 @@ static int dhcp6_no_relay(struct state * v6_id.next = state->tags; state->tags = &v6_id; - /* copy over transaction-id, and save pointer to message type */ - if (!(outmsgtypep = put_opt6(inbuff, 4))) + start_msg = save_counter(-1); + /* copy over transaction-id */ + if (!put_opt6(inbuff, 4)) return 0; start_opts = save_counter(-1); - state->xid = outmsgtypep[3] | outmsgtypep[2] << 8 | outmsgtypep[1] << 16; - + state->xid = inbuff[3] | inbuff[2] << 8 | inbuff[1] << 16; + /* We're going to be linking tags from all context we use. mark them as unused so we don't link one twice and break the list */ for (context_tmp = state->context; context_tmp; context_tmp = context_tmp->current) @@ -347,7 +348,7 @@ static int dhcp6_no_relay(struct state * (msg_type == DHCP6REQUEST || msg_type == DHCP6RENEW || msg_type == DHCP6RELEASE || msg_type == DHCP6DECLINE)) { - *outmsgtypep = DHCP6REPLY; + outmsgtype = DHCP6REPLY; o1 = new_opt6(OPTION6_STATUS_CODE); put_opt6_short(DHCP6USEMULTI); put_opt6_string("Use multicast"); @@ -619,11 +620,11 @@ static int dhcp6_no_relay(struct state * struct dhcp_netid *solicit_tags; struct dhcp_context *c; - *outmsgtypep = DHCP6ADVERTISE; + outmsgtype = DHCP6ADVERTISE; if (opt6_find(state->packet_options, state->end, OPTION6_RAPID_COMMIT, 0)) { - *outmsgtypep = DHCP6REPLY; + outmsgtype = DHCP6REPLY; state->lease_allocate = 1; o = new_opt6(OPTION6_RAPID_COMMIT); end_opt6(o); @@ -809,7 +810,7 @@ static int dhcp6_no_relay(struct state * int start = save_counter(-1); /* set reply message type */ - *outmsgtypep = DHCP6REPLY; + outmsgtype = DHCP6REPLY; state->lease_allocate = 1; log6_quiet(state, "DHCPREQUEST", NULL, ignore ? _("ignored") : NULL); @@ -924,7 +925,7 @@ static int dhcp6_no_relay(struct state * int address_assigned = 0; /* set reply message type */ - *outmsgtypep = DHCP6REPLY; + outmsgtype = DHCP6REPLY; log6_quiet(state, msg_type == DHCP6RENEW ? "DHCPRENEW" : "DHCPREBIND", NULL, NULL); @@ -1057,7 +1058,7 @@ static int dhcp6_no_relay(struct state * int good_addr = 0; /* set reply message type */ - *outmsgtypep = DHCP6REPLY; + outmsgtype = DHCP6REPLY; log6_quiet(state, "DHCPCONFIRM", NULL, NULL); @@ -1121,7 +1122,7 @@ static int dhcp6_no_relay(struct state * log6_quiet(state, "DHCPINFORMATION-REQUEST", NULL, ignore ? _("ignored") : state->hostname); if (ignore) return 0; - *outmsgtypep = DHCP6REPLY; + outmsgtype = DHCP6REPLY; tagif = add_options(state, 1); break; } @@ -1130,7 +1131,7 @@ static int dhcp6_no_relay(struct state * case DHCP6RELEASE: { /* set reply message type */ - *outmsgtypep = DHCP6REPLY; + outmsgtype = DHCP6REPLY; log6_quiet(state, "DHCPRELEASE", NULL, NULL); @@ -1195,7 +1196,7 @@ static int dhcp6_no_relay(struct state * case DHCP6DECLINE: { /* set reply message type */ - *outmsgtypep = DHCP6REPLY; + outmsgtype = DHCP6REPLY; log6_quiet(state, "DHCPDECLINE", NULL, NULL); @@ -1275,7 +1276,12 @@ static int dhcp6_no_relay(struct state * } } - + + /* Fill in the message type. Note that we store the offset, + not a direct pointer, since the packet memory may have been + reallocated. */ + ((unsigned char *)(daemon->outpacket.iov_base))[start_msg] = outmsgtype; + log_tags(tagif, state->xid); log6_opts(0, state->xid, daemon->outpacket.iov_base + start_opts, daemon->outpacket.iov_base + save_counter(-1));
