Date: Tue, 24 Aug 2021 18:28:40 GMT From: Gordon Tetlow <gordon@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 8c8400954f30 - stable/12 - Fix remote code execution in ggatec(8). Message-ID: <202108241828.17OISebx023442@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/12 has been updated by gordon: URL: https://cgit.FreeBSD.org/src/commit/?id=8c8400954f308680cd2862b417495cf656ed85fa commit 8c8400954f308680cd2862b417495cf656ed85fa Author: Gordon Tetlow <gordon@FreeBSD.org> AuthorDate: 2021-08-24 17:40:49 +0000 Commit: Gordon Tetlow <gordon@FreeBSD.org> CommitDate: 2021-08-24 17:51:09 +0000 Fix remote code execution in ggatec(8). Approved by: so Security: SA-21:14.ggatec Security: CVE-2021-29630 (cherry picked from commit 515216929c40169cc72b62466ff9238682661613) --- sbin/ggate/ggatec/ggatec.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/sbin/ggate/ggatec/ggatec.c b/sbin/ggate/ggatec/ggatec.c index 45a93c4512fe..0695dae0dca2 100644 --- a/sbin/ggate/ggatec/ggatec.c +++ b/sbin/ggate/ggatec/ggatec.c @@ -145,7 +145,21 @@ send_thread(void *arg __unused) case BIO_WRITE: hdr.gh_cmd = GGATE_CMD_WRITE; break; + default: + g_gate_log(LOG_NOTICE, "Unknown gctl_cmd: %i", ggio.gctl_cmd); + ggio.gctl_error = EOPNOTSUPP; + g_gate_ioctl(G_GATE_CMD_DONE, &ggio); + continue; + } + + /* Don't send requests for more data than we can handle the response for! */ + if (ggio.gctl_length > MAXPHYS) { + g_gate_log(LOG_ERR, "Request too big: %zd", ggio.gctl_length); + ggio.gctl_error = EOPNOTSUPP; + g_gate_ioctl(G_GATE_CMD_DONE, &ggio); + continue; } + hdr.gh_seq = ggio.gctl_seq; hdr.gh_offset = ggio.gctl_offset; hdr.gh_length = ggio.gctl_length; @@ -219,6 +233,12 @@ recv_thread(void *arg __unused) ggio.gctl_length = hdr.gh_length; ggio.gctl_error = hdr.gh_error; + /* Do not overflow our buffer if there is a bogus response. */ + if (ggio.gctl_length > (off_t) sizeof(buf)) { + g_gate_log(LOG_ERR, "Received too big response: %zd", ggio.gctl_length); + break; + } + if (ggio.gctl_error == 0 && ggio.gctl_cmd == GGATE_CMD_READ) { data = g_gate_recv(recvfd, ggio.gctl_data, ggio.gctl_length, MSG_WAITALL);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202108241828.17OISebx023442>