Date: Sat, 21 Oct 2000 13:44:19 +0400 (MSD) From: yar@comp.chem.msu.su To: FreeBSD-gnats-submit@freebsd.org Subject: kern/22177: in_arpinput() doesn't call m_pullup() while it should Message-ID: <200010210944.e9L9iJZ00639@yar.chem.msu.su>
next in thread | raw e-mail | index | archive | help
>Number: 22177
>Category: kern
>Synopsis: in_arpinput() doesn't call m_pullup() while it should
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sat Oct 21 02:50:01 PDT 2000
>Closed-Date:
>Last-Modified:
>Originator: Yar Tikhiy
>Release: FreeBSD 4.1-STABLE i386
>Organization:
Moscow State University
>Environment:
The bug show up in all branches.
>Description:
The processing of incoming ARP packets is split into two
parts, the lower one (arpintr()) being protocol-independent,
and the uppper one (in_arpinput) being IP-specific. The
lower one uses m_pullup() to ensure the arp header is
contiguous in memory and can be accessed with mtod().
However, the length of data being pulled up is smaller than
required for IP ARP (but still enough for the protocol-independent
part of the ARP header). The upper part doesn't call
m_pullup() at all and so can be made by a malicious cracker
sending too short ARP packets to access memory beyond the
actual data boundary. Of course, there is usually some
spare space in a mbuf cluster there, but that's still a
dangerous behaviour.
Moreover, that may break some sophisticated encapsulation
schemes, such as VLANs (and it does break in some cases)
Thus, yet another m_pullup() won't hurt.
>How-To-Repeat:
Take a look at the code in file netinet/if_ether.c,
functions arpintr() and in_arpinput()
>Fix:
--- netinet/if_ether.c.orig Tue Apr 11 11:08:35 2000
+++ netinet/if_ether.c Fri Oct 20 03:03:23 2000
@@ -506,6 +506,12 @@
struct in_addr isaddr, itaddr, myaddr;
int op;
+ if (m->m_len < sizeof(struct ether_arp) &&
+ (m = m_pullup(m, sizeof(struct ether_arp))) == NULL) {
+ log(LOG_ERR, "arp: runt packet -- m_pullup failed\n");
+ return;
+ }
+
ea = mtod(m, struct ether_arp *);
op = ntohs(ea->arp_op);
(void)memcpy(&isaddr, ea->arp_spa, sizeof (isaddr));
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200010210944.e9L9iJZ00639>