Control: tags 989662 + patch Control: tags 989662 + pending
Dear maintainer, I've prepared an NMU for connman (versioned as 1.36-2.2) and uploaded it to DELAYED/2. Please feel free to tell me if I should delay it longer. Alf, this is sort of not respecting the rules for NMU, my goal here would be to make it possible to make as well an update for buster in time. So if you agree I would even shorten the delay. If you want to override the upload this is obviously perfectly fine! Regards, Salvatore
diff -Nru connman-1.36/debian/changelog connman-1.36/debian/changelog --- connman-1.36/debian/changelog 2021-02-05 14:42:50.000000000 +0100 +++ connman-1.36/debian/changelog 2021-06-09 20:48:07.000000000 +0200 @@ -1,3 +1,11 @@ +connman (1.36-2.2) unstable; urgency=high + + * Non-maintainer upload. + * dnsproxy: Check the length of buffers before memcpy (CVE-2021-33833) + (Closes: #989662) + + -- Salvatore Bonaccorso <car...@debian.org> Wed, 09 Jun 2021 20:48:07 +0200 + connman (1.36-2.1) unstable; urgency=high * Non-maintainer upload. diff -Nru connman-1.36/debian/patches/dnsproxy-Check-the-length-of-buffers-before-memcpy.patch connman-1.36/debian/patches/dnsproxy-Check-the-length-of-buffers-before-memcpy.patch --- connman-1.36/debian/patches/dnsproxy-Check-the-length-of-buffers-before-memcpy.patch 1970-01-01 01:00:00.000000000 +0100 +++ connman-1.36/debian/patches/dnsproxy-Check-the-length-of-buffers-before-memcpy.patch 2021-06-09 20:46:50.000000000 +0200 @@ -0,0 +1,68 @@ +From: Valery Kashcheev <v.kasch...@omp.ru> +Date: Mon, 7 Jun 2021 18:58:24 +0200 +Subject: dnsproxy: Check the length of buffers before memcpy +Origin: https://git.kernel.org/pub/scm/network/connman/connman.git/commit?id=eceb2e8d2341c041df55a5e2f047d9a8c491463c +Bug-Debian: https://bugs.debian.org/989662 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2021-33833 + +Fix using a stack-based buffer overflow attack by checking the length of +the ptr and uptr buffers. + +Fix debug message output. + +Fixes: CVE-2021-33833 +--- + src/dnsproxy.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/src/dnsproxy.c b/src/dnsproxy.c +index de52df5ad0a0..38dbdd71e425 100644 +--- a/src/dnsproxy.c ++++ b/src/dnsproxy.c +@@ -1788,17 +1788,15 @@ static char *uncompress(int16_t field_count, char *start, char *end, + * tmp buffer. + */ + +- debug("pos %d ulen %d left %d name %s", pos, ulen, +- (int)(uncomp_len - (uptr - uncompressed)), uptr); +- +- ulen = strlen(name); +- if ((uptr + ulen + 1) > uncomp_end) { ++ ulen = strlen(name) + 1; ++ if ((uptr + ulen) > uncomp_end) + goto out; +- } +- strncpy(uptr, name, uncomp_len - (uptr - uncompressed)); ++ strncpy(uptr, name, ulen); ++ ++ debug("pos %d ulen %d left %d name %s", pos, ulen, ++ (int)(uncomp_end - (uptr + ulen)), uptr); + + uptr += ulen; +- *uptr++ = '\0'; + + ptr += pos; + +@@ -1841,7 +1839,7 @@ static char *uncompress(int16_t field_count, char *start, char *end, + } else if (dns_type == ns_t_a || dns_type == ns_t_aaaa) { + dlen = uptr[-2] << 8 | uptr[-1]; + +- if (ptr + dlen > end) { ++ if ((ptr + dlen) > end || (uptr + dlen) > uncomp_end) { + debug("data len %d too long", dlen); + goto out; + } +@@ -1880,6 +1878,10 @@ static char *uncompress(int16_t field_count, char *start, char *end, + * refresh interval, retry interval, expiration + * limit and minimum ttl). They are 20 bytes long. + */ ++ if ((uptr + 20) > uncomp_end || (ptr + 20) > end) { ++ debug("soa record too long"); ++ goto out; ++ } + memcpy(uptr, ptr, 20); + uptr += 20; + ptr += 20; +-- +2.32.0 + diff -Nru connman-1.36/debian/patches/series connman-1.36/debian/patches/series --- connman-1.36/debian/patches/series 2021-02-05 14:41:13.000000000 +0100 +++ connman-1.36/debian/patches/series 2021-06-09 20:47:04.000000000 +0200 @@ -4,3 +4,4 @@ gdhcp-Avoid-reading-invalid-data-in-dhcp_get_option.patch gdhcp-Avoid-leaking-stack-data-via-unitiialized-vari.patch dnsproxy-Add-length-checks-to-prevent-buffer-overflo.patch +dnsproxy-Check-the-length-of-buffers-before-memcpy.patch
