An issue found in TCPReplay v.4.4.3 allows a remote attacker to cause a denial
of service via
the read_hexstring function at the utils.c:309 endpoint, the read_hexstring
function at
the utils.c:309 endpoint, the macinstring function, the parse_list function at
the list.c:81 endpoint,
the ports2PORT function at the portmap.c:69 endpoint and the cidr2cidr function
at the cidr.c:178 endpoint.
This security patch incorporates fixes for below list of CVEs
CVE-2023-27784
CVE-2023-27785
CVE-2023-27786
CVE-2023-27787
CVE-2023-27788
CVE-2023-27789
References:
https://nvd.nist.gov/vuln/detail/CVE-2023-27784
https://nvd.nist.gov/vuln/detail/CVE-2023-27785
https://nvd.nist.gov/vuln/detail/CVE-2023-27786
https://nvd.nist.gov/vuln/detail/CVE-2023-27787
https://nvd.nist.gov/vuln/detail/CVE-2023-27788
https://nvd.nist.gov/vuln/detail/CVE-2023-27789
https://github.com/appneta/tcpreplay/pull/783
Signed-off-by: Archana Polampalli <archana.polampa...@windriver.com>
---
.../tcpreplay/tcpreplay/CVE-2023-27784.patch | 94 +++++++++++++++++++
.../tcpreplay/tcpreplay_4.4.2.bb | 1 +
2 files changed, 95 insertions(+)
create mode 100644
meta-networking/recipes-support/tcpreplay/tcpreplay/CVE-2023-27784.patch
diff --git
a/meta-networking/recipes-support/tcpreplay/tcpreplay/CVE-2023-27784.patch
b/meta-networking/recipes-support/tcpreplay/tcpreplay/CVE-2023-27784.patch
new file mode 100644
index 000000000..d8b317e86
--- /dev/null
+++ b/meta-networking/recipes-support/tcpreplay/tcpreplay/CVE-2023-27784.patch
@@ -0,0 +1,94 @@
+From df18c48812462ea802d639d2477887055666ee58 Mon Sep 17 00:00:00 2001
+From: Marsman1996 <lqliuyu...@outlook.com>
+Date: Wed Mar 1 16:52:35 2023 +0800
+Subject: [PATCH] Add check after call strtok_r
+
+CVE: CVE-2023-27784
+
+Upstream-Status: Backport
[https://github.com/appneta/tcpreplay/commit/342d29d9e42898b1e097a9f9a31fe0ad15d2f43b]
+
+Signed-off-by: Archana Polampalli <archana.polampa...@windriver.com>
+---
+ src/common/cidr.c | 4 ++++
+ src/common/list.c | 2 +-
+ src/common/mac.c | 2 +-
+ src/common/utils.c | 2 ++
+ src/tcpedit/portmap.c | 2 +-
+ 5 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/src/common/cidr.c b/src/common/cidr.c
+index 59aaf87..4fc8aad 100644
+--- a/src/common/cidr.c
++++ b/src/common/cidr.c
+@@ -295,6 +295,8 @@ parse_cidr(tcpr_cidr_t ** cidrdata, char *cidrin, char
*delim)
+
+ /* first iteration of input using strtok */
+ network = strtok_r(cidrin, delim, &token);
++ if (network == NULL)
++ return 0;
+
+ *cidrdata = cidr2cidr(network);
+ cidr_ptr = *cidrdata;
+@@ -362,6 +364,8 @@ parse_endpoints(tcpr_cidrmap_t ** cidrmap1, tcpr_cidrmap_t
** cidrmap2, const ch
+ /* ipv4 mode */
+ memset(newmap, '\0', NEWMAP_LEN);
+ map = strtok_r(string, ":", &token);
++ if (map == NULL)
++ goto done;
+
+ strlcpy(newmap, "0.0.0.0/0:", NEWMAP_LEN);
+ strlcat(newmap, map, NEWMAP_LEN);
+diff --git a/src/common/list.c b/src/common/list.c
+index 303e5a5..fbd5450 100644
+--- a/src/common/list.c
++++ b/src/common/list.c
+@@ -78,7 +78,7 @@ parse_list(tcpr_list_t ** listdata, char *ourstr)
+ second = NULL;
+
+ /* regex test */
+- if (regexec(&preg, this, 0, NULL, 0) != 0) {
++ if (this == NULL || regexec(&preg, this, 0, NULL, 0) != 0) {
+ warnx("Unable to parse: %s", this);
+ regfree(&preg);
+ return 0;
+diff --git a/src/common/mac.c b/src/common/mac.c
+index 3747a17..8ec2df3 100644
+--- a/src/common/mac.c
++++ b/src/common/mac.c
+@@ -117,7 +117,7 @@ macinstring(const char *macstring, const u_char *mac)
+ memset(&tempmac[0], 0, sizeof(tempmac));
+
+ tempstr = strtok_r(ourstring, ",", &tok);
+- if (strlen(tempstr)) {
++ if (tempstr != NULL && strlen(tempstr)) {
+ mac2hex(tempstr, tempmac, len);
+ if (memcmp(mac, tempmac, len) == 0) {
+ dbgx(3, "Packet matches: " MAC_FORMAT " sending out primary.\n",
MAC_STR(tempmac));
+diff --git a/src/common/utils.c b/src/common/utils.c
+index a641939..fcfddb5 100644
+--- a/src/common/utils.c
++++ b/src/common/utils.c
+@@ -306,6 +306,8 @@ read_hexstring(const char *l2string, u_char *hex, const
int hexlen)
+
+ /* get the first byte */
+ l2byte = strtok_r(string, ",", &token);
++ if (l2byte == NULL)
++ err(-1, "Hex buffer must contain something");
+ sscanf(l2byte, "%x", &value);
+ if (value > 0xff)
+ errx(-1, "Invalid hex string byte: %s", l2byte);
+diff --git a/src/tcpedit/portmap.c b/src/tcpedit/portmap.c
+index 61c0d2a..ebafe39 100644
+--- a/src/tcpedit/portmap.c
++++ b/src/tcpedit/portmap.c
+@@ -194,7 +194,7 @@ parse_portmap(tcpedit_portmap_t ** portmap, const char
*ourstr)
+ /* first iteration of input */
+ substr = strtok_r(ourstrcpy, ",", &token);
+
+- if ((*portmap = ports2PORT(substr)) == NULL) {
++ if (substr == NULL || (*portmap = ports2PORT(substr)) == NULL) {
+ safe_free(ourstrcpy);
+ return 0;
+ }
+--
+2.40.0
diff --git a/meta-networking/recipes-support/tcpreplay/tcpreplay_4.4.2.bb
b/meta-networking/recipes-support/tcpreplay/tcpreplay_4.4.2.bb
index ccff19f16..1e240c69e 100644
--- a/meta-networking/recipes-support/tcpreplay/tcpreplay_4.4.2.bb
+++ b/meta-networking/recipes-support/tcpreplay/tcpreplay_4.4.2.bb
@@ -9,6 +9,7 @@ LIC_FILES_CHKSUM =
"file://docs/LICENSE;md5=10f0474a2f0e5dccfca20f69d6598ad8"
SRC_URI =
"https://github.com/appneta/tcpreplay/releases/download/v${PV}/tcpreplay-${PV}.tar.gz
\
file://CVE-2023-27783.patch \
+ file://CVE-2023-27784.patch \
"
SRC_URI[sha256sum] =
"5b272cd83b67d6288a234ea15f89ecd93b4fadda65eddc44e7b5fcb2f395b615"
--
2.40.0
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#103127):
https://lists.openembedded.org/g/openembedded-devel/message/103127
Mute This Topic: https://lists.openembedded.org/mt/99337534/21656
Group Owner: openembedded-devel+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
