Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 9 Apr 2011 10:58:38 +0000 (UTC)
From:      "Bjoern A. Zeeb" <bz@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-7@freebsd.org
Subject:   svn commit: r220484 - stable/7/sys/netipsec
Message-ID:  <201104091058.p39AwcoG011594@svn.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: bz
Date: Sat Apr  9 10:58:38 2011
New Revision: 220484
URL: http://svn.freebsd.org/changeset/base/220484

Log:
  MFC r220247:
  
     Do not allow directly recursive RFC3173 IPComp payload.
  
  Security:	CVE-2011-1547

Modified:
  stable/7/sys/netipsec/xform_ipcomp.c
Directory Properties:
  stable/7/sys/   (props changed)
  stable/7/sys/cddl/contrib/opensolaris/   (props changed)
  stable/7/sys/contrib/dev/acpica/   (props changed)
  stable/7/sys/contrib/pf/   (props changed)

Modified: stable/7/sys/netipsec/xform_ipcomp.c
==============================================================================
--- stable/7/sys/netipsec/xform_ipcomp.c	Sat Apr  9 10:53:36 2011	(r220483)
+++ stable/7/sys/netipsec/xform_ipcomp.c	Sat Apr  9 10:58:38 2011	(r220484)
@@ -139,10 +139,31 @@ ipcomp_input(struct mbuf *m, struct seca
 	struct tdb_crypto *tc;
 	struct cryptodesc *crdc;
 	struct cryptop *crp;
+	struct ipcomp *ipcomp;
+	caddr_t addr;
 	int hlen = IPCOMP_HLENGTH;
 
 	IPSEC_SPLASSERT_SOFTNET(__func__);
 
+	/*
+	 * Check that the next header of the IPComp is not IPComp again, before
+	 * doing any real work.  Given it is not possible to do double
+	 * compression it means someone is playing tricks on us.
+	 */
+	if (m->m_len < skip + hlen && (m = m_pullup(m, skip + hlen)) == NULL) {
+		ipcompstat.ipcomps_hdrops++;		/*XXX*/
+		DPRINTF(("%s: m_pullup failed\n", __func__));
+		return (ENOBUFS);
+	}
+	addr = (caddr_t) mtod(m, struct ip *) + skip;
+	ipcomp = (struct ipcomp *)addr;
+	if (ipcomp->comp_nxt == IPPROTO_IPCOMP) {
+		m_freem(m);
+		ipcompstat.ipcomps_pdrops++;	/* XXX have our own stats? */
+		DPRINTF(("%s: recursive compression detected\n", __func__));
+		return (EINVAL);
+	}
+
 	/* Get crypto descriptors */
 	crp = crypto_getreq(1);
 	if (crp == NULL) {



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201104091058.p39AwcoG011594>