Gert Doering has submitted this change. ( https://gerrit.openvpn.net/c/openvpn/+/2027?usp=email )
Change subject: interactive: null-terminate iface.name in address and route handlers ...................................................................... interactive: null-terminate iface.name in address and route handlers HandleAddressMessage() and HandleRouteMessage() pass the client supplied interface name to InterfaceLuid() and strlen() without making sure it is null-terminated. A pipe client sending a message with iface.index set to TUN_ADAPTER_INDEX_INVALID and a 256 byte name without a terminating NUL makes the service read past the name into the remainder of the on-stack pipe_message_t and beyond. This is hardening rather than a fix for an exploitable bug: the trailing bytes only ever reach ConvertInterfaceAliasToLuid(), which fails on them, and nothing is returned to the client beyond an error code. Terminate the name anyway, like HandleDNSConfigMessage() and HandleDNSConfigNrptMessage() already do. Github: OpenVPN/openvpn#1130 Change-Id: I26fe14053446dbd215f947910565c20318c34627 Signed-off-by: Naveed Khan <[email protected]> Signed-off-by: Lev Stipakov <[email protected]> Acked-by: Heiko Hund <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2027 Message-Id: <[email protected]> URL: https://www.mail-archive.com/[email protected]/msg40085.html Signed-off-by: Gert Doering <[email protected]> --- M src/openvpnserv/interactive.c 1 file changed, 6 insertions(+), 0 deletions(-) diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c index ed163a4..d36e8d5 100644 --- a/src/openvpnserv/interactive.c +++ b/src/openvpnserv/interactive.c @@ -575,6 +575,9 @@ PMIB_UNICASTIPADDRESS_ROW addr_row; BOOL add = msg->header.type == msg_add_address; + /* enforce null-termination of the interface name from client */ + msg->iface.name[_countof(msg->iface.name) - 1] = '\0'; + addr_row = malloc(sizeof(*addr_row)); if (addr_row == NULL) { @@ -653,6 +656,9 @@ PMIB_IPFORWARD_ROW2 fwd_row; BOOL add = msg->header.type == msg_add_route; + /* enforce null-termination of the interface name from client */ + msg->iface.name[_countof(msg->iface.name) - 1] = '\0'; + fwd_row = malloc(sizeof(*fwd_row)); if (fwd_row == NULL) { -- To view, visit https://gerrit.openvpn.net/c/openvpn/+/2027?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.openvpn.net/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I26fe14053446dbd215f947910565c20318c34627 Gerrit-Change-Number: 2027 Gerrit-PatchSet: 2 Gerrit-Owner: Lev Stipakov <[email protected]> Gerrit-Reviewer: Arne Schwabe <[email protected]> Gerrit-Reviewer: Heiko Hund <[email protected]> Gerrit-CC: openvpn-devel <[email protected]>
_______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
