Your message dated Mon, 17 Apr 2023 21:02:33 +0000
with message-id <[email protected]>
and subject line unblock connman
has caused the Debian Bug report #1034533,
regarding unblock: connman/1.41-3
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1034533: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034533
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Control: affects -1 + src:connman
X-Debbugs-Cc: [email protected]
User: [email protected]
Usertags: unblock
Severity: normal
Please unblock package connman.
[ Reason ]
Open CVE-2023-28488 in bookworm
[ Impact ]
User is vulnerable for CVE-2023-28488.
[ Tests ]
Exploit at https://github.com/moehw/poc_exploits/tree/master/CVE-2023-28488
[ Risks ]
None.
[ Checklist ]
[x] all changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in testing
unblock connman/1.41-3
diff -Nru connman-1.41/debian/changelog connman-1.41/debian/changelog
--- connman-1.41/debian/changelog 2022-08-19 07:20:06.000000000 +0200
+++ connman-1.41/debian/changelog 2023-04-14 11:45:14.000000000 +0200
@@ -1,3 +1,9 @@
+connman (1.41-3) unstable; urgency=medium
+
+ * gdhcp: Verify and sanitize packet length first (CVE-2023-28488)
+
+ -- Vignesh Raman <[email protected]> Fri, 14 Apr 2023 15:15:14
+0530
+
connman (1.41-2) unstable; urgency=medium
* d/patches: (Closes: #1016976)
diff -Nru
connman-1.41/debian/patches/gdhcp-Verify-and-sanitize-packet-length-first.patch
connman-1.41/debian/patches/gdhcp-Verify-and-sanitize-packet-length-first.patch
---
connman-1.41/debian/patches/gdhcp-Verify-and-sanitize-packet-length-first.patch
1970-01-01 01:00:00.000000000 +0100
+++
connman-1.41/debian/patches/gdhcp-Verify-and-sanitize-packet-length-first.patch
2023-04-14 11:45:14.000000000 +0200
@@ -0,0 +1,58 @@
+From 99e2c16ea1cced34a5dc450d76287a1c3e762138 Mon Sep 17 00:00:00 2001
+From: Daniel Wagner <[email protected]>
+Date: Tue, 11 Apr 2023 08:12:56 +0200
+Subject: [PATCH] gdhcp: Verify and sanitize packet length first
+
+Avoid overwriting the read packet length after the initial test. Thus
+move all the length checks which depends on the total length first
+and do not use the total lenght from the IP packet afterwards.
+
+Fixes CVE-2023-28488
+
+Reported by Polina Smirnova <[email protected]>
+---
+ gdhcp/client.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/gdhcp/client.c b/gdhcp/client.c
+index 7efa7e45..82017692 100644
+--- a/gdhcp/client.c
++++ b/gdhcp/client.c
+@@ -1319,9 +1319,9 @@ static bool sanity_check(struct ip_udp_dhcp_packet
*packet, int bytes)
+ static int dhcp_recv_l2_packet(struct dhcp_packet *dhcp_pkt, int fd,
+ struct sockaddr_in *dst_addr)
+ {
+- int bytes;
+ struct ip_udp_dhcp_packet packet;
+ uint16_t check;
++ int bytes, tot_len;
+
+ memset(&packet, 0, sizeof(packet));
+
+@@ -1329,15 +1329,17 @@ static int dhcp_recv_l2_packet(struct dhcp_packet
*dhcp_pkt, int fd,
+ if (bytes < 0)
+ return -1;
+
+- if (bytes < (int) (sizeof(packet.ip) + sizeof(packet.udp)))
+- return -1;
+-
+- if (bytes < ntohs(packet.ip.tot_len))
++ tot_len = ntohs(packet.ip.tot_len);
++ if (bytes > tot_len) {
++ /* ignore any extra garbage bytes */
++ bytes = tot_len;
++ } else if (bytes < tot_len) {
+ /* packet is bigger than sizeof(packet), we did partial read */
+ return -1;
++ }
+
+- /* ignore any extra garbage bytes */
+- bytes = ntohs(packet.ip.tot_len);
++ if (bytes < (int) (sizeof(packet.ip) + sizeof(packet.udp)))
++ return -1;
+
+ if (!sanity_check(&packet, bytes))
+ return -1;
+--
+2.30.2
+
diff -Nru connman-1.41/debian/patches/series connman-1.41/debian/patches/series
--- connman-1.41/debian/patches/series 2022-08-19 07:20:06.000000000 +0200
+++ connman-1.41/debian/patches/series 2023-04-14 11:45:14.000000000 +0200
@@ -3,3 +3,4 @@
wispr-Add-reference-counter-to-portal-context.patch
wispr-Update-portal-context-references.patch
gweb-Fix-OOB-write-in-received_data.patch
+gdhcp-Verify-and-sanitize-packet-length-first.patch
--- End Message ---
--- Begin Message ---
Unblocked.
--- End Message ---
