1. photon
  2. Commit 5b060d1c4b32dfd363ef38128dceccda70b5c381
Browse code

tcpdump: Patched for CVE-2024-2397

Change-Id: Ie02dfbe9b276221c3c3568991ac9f55ed6dd96d8
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/c/photon/+/23614
Reviewed-by: Shreenidhi Shedi <shreenidhi.shedi@broadcom.com>
Tested-by: gerrit-photon <photon-checkins@vmware.com>

Nitesh authored on 2024/03/28 19:46:08
Showing 2 changed files
SPECS/tcpdump/CVE-2024-2397.patch
History View file @ 5b060d1
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,128 @@
0 
+From b9811ef5bb1b7d45a90e042f81f3aaf233c8bcb2 Mon Sep 17 00:00:00 2001
1 
+From: Guy Harris <gharris@sonic.net>
2 
+Date: Tue, 12 Mar 2024 00:37:23 -0700
3 
+Subject: [PATCH] ppp: use the buffer stack for the de-escaping buffer.
4 
+
5 
+This both saves the buffer for freeing later and saves the packet
6 
+pointer and snapend to be restored when packet processing is complete,
7 
+even if an exception is thrown with longjmp.
8 
+
9 
+This means that the hex/ASCII printing in pretty_print_packet()
10 
+processes the packet data as captured or read from the savefile, rather
11 
+than as modified by the PPP printer, so that the bounds checking is
12 
+correct.
13 
+
14 
+That fixes CVE-2024-2397, which was caused by an exception being thrown
15 
+by the hex/ASCII printer (which should only happen if those routines are
16 
+called by a packet printer, not if they're called for the -X/-x/-A
17 
+flag), which jumps back to the setjmp() that surrounds the packet
18 
+printer.  Hilarity^Winfinite looping ensues.
19 
+
20 
+Also, restore ndo->ndo_packetp before calling the hex/ASCII printing
21 
+routine, in case nd_pop_all_packet_info() didn't restore it.
22 
+
23 
+[kunitsh@vmware.com: ported fix to v4.99.4]
24 
+Signed-off-by: Nitesh Kumar <nitesh-nk.kumar@broadcom.com>
25 
+---
26 
+ print-ppp.c | 31 +++++++++++++++++--------------
27 
+ print.c     |  8 ++++++--
28 
+ 2 files changed, 23 insertions(+), 16 deletions(-)
29 
+
30 
+diff --git a/print-ppp.c b/print-ppp.c
31 
+index aba243d..eb13ddd 100644
32 
+--- a/print-ppp.c
33 
+@@ -37,6 +37,8 @@
34 
+
35 
+ #include "netdissect-stdinc.h"
36 
+
37 
++#include <stdlib.h>
38 
++
39 
+ #ifdef __bsdi__
40 
+ #include <net/slcompress.h>
41 
+ #include <net/if_ppp.h>
42 
+@@ -1363,7 +1365,6 @@ ppp_hdlc(netdissect_options *ndo,
43 
+ 	u_char *b, *t, c;
44 
+ 	const u_char *s;
45 
+ 	u_int i, proto;
46 
+-	const void *sb, *se;
47 
+
48 
+ 	if (caplen == 0)
49 
+ 		return;
50 
+@@ -1371,9 +1372,11 @@ ppp_hdlc(netdissect_options *ndo,
51 
+         if (length == 0)
52 
+                 return;
53 
+
54 
+-	b = (u_char *)nd_malloc(ndo, caplen);
55 
+-	if (b == NULL)
56 
+-		return;
57 
++        b = (u_char *)malloc(caplen);
58 
++        if (b == NULL) {
59 
++                (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
60 
++                        "%s: malloc", __func__);
61 
++        }
62 
+
63 
+ 	/*
64 
+ 	 * Unescape all the data into a temporary, private, buffer.
65 
+@@ -1394,13 +1397,15 @@ ppp_hdlc(netdissect_options *ndo,
66 
+ 	}
67 
+
68 
+ 	/*
69 
+-	 * Change the end pointer, so bounds checks work.
70 
+-	 * Change the pointer to packet data to help debugging.
71 
++	 * Switch to the output buffer for dissection, and save it
72 
++	 * on the buffer stack so it can be freed; our caller must
73 
++	 * pop it when done.
74 
+ 	 */
75 
+-	sb = ndo->ndo_packetp;
76 
+-	se = ndo->ndo_snapend;
77 
+-	ndo->ndo_packetp = b;
78 
+-	ndo->ndo_snapend = t;
79 
++        if (!nd_push_buffer(ndo, b, b, (u_int)(t - b))) {
80 
++                free(b);
81 
++                (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
82 
++                        "%s: can't push buffer on buffer stack", __func__);
83 
++        }
84 
+ 	length = ND_BYTES_AVAILABLE_AFTER(b);
85 
+
86 
+         /* now lets guess about the payload codepoint format */
87 
+@@ -1442,13 +1447,11 @@ ppp_hdlc(netdissect_options *ndo,
88 
+         }
89 
+
90 
+ cleanup:
91 
+-	ndo->ndo_packetp = sb;
92 
+-	ndo->ndo_snapend = se;
93 
++	nd_pop_packet_info(ndo);
94 
+         return;
95 
+
96 
+ trunc:
97 
+-	ndo->ndo_packetp = sb;
98 
+-	ndo->ndo_snapend = se;
99 
++	nd_pop_packet_info(ndo);
100 
+ 	nd_print_trunc(ndo);
101 
+ }
102 
+
103 
+diff --git a/print.c b/print.c
104 
+index 9c0ab86..33706b9 100644
105 
+--- a/print.c
106 
+@@ -431,10 +431,14 @@ pretty_print_packet(netdissect_options *ndo, const struct pcap_pkthdr *h,
107 
+ 	nd_pop_all_packet_info(ndo);
108 
+
109 
+ 	/*
110 
+-	 * Restore the original snapend, as a printer might have
111 
+-	 * changed it.
112 
++	 * Restore the originals snapend and packetp, as a printer
113 
++	 * might have changed them.
114 
++	 *
115 
++	 * XXX - nd_pop_all_packet_info() should have restored the
116 
++	 * original values, but, just in case....
117 
+ 	 */
118 
+ 	ndo->ndo_snapend = sp + h->caplen;
119 
++	ndo->ndo_packetp = sp;
120 
+ 	if (ndo->ndo_Xflag) {
121 
+ 		/*
122 
+ 		 * Print the raw packet data in hex and ASCII.
123 
+--
124 
+2.34.1
125 
+
SPECS/tcpdump/tcpdump.spec
History View file @ 5b060d1
... ... 
@@ -1,7 +1,7 @@
1 1 
 Summary:        Packet Analyzer
2 2 
 Name:           tcpdump
3 3 
 Version:        4.99.4
4 
-Release:        1%{?dist}
4 
+Release:        2%{?dist}
5 5 
 License:        BSD
6 6 
 URL:            http://www.tcpdump.org
7 7 
 Group:          Networking
... ... 
@@ -11,6 +11,8 @@ Distribution:   Photon
11 11 
 Source0: http://www.tcpdump.org/release/%{name}-%{version}.tar.gz
12 12 
 %define sha512 tcpdump=cb51e19574707d07c0de90dd4c301955897f2c9f2a69beb7162c08f59189f55625346d1602c8d66ab2b4c626ea4b0df1f08ed8734d2d7f536d0a7840c2d6d8df
13 13
14 
+Patch0: CVE-2024-2397.patch
15 
+
14 16 
 BuildRequires: libpcap-devel
15 17
16 18 
 Requires: libpcap
... ... 
@@ -21,7 +23,7 @@ It allows the user to display TCP/IP and other packets being
21 21 
 transmitted or received over a network to which the computer is attached.
22 22
23 23 
 %prep
24 
-%autosetup
24 
+%autosetup -p1
25 25
26 26 
 %build
27 27 
 %configure
... ... 
@@ -42,6 +44,8 @@ make %{?_smp_mflags} check
42 42 
 %{_mandir}/man1/tcpdump.1.gz
43 43
44 44 
 %changelog
45 
+* Thu Mar 28 2024 Nitesh Kumar <nitesh-nk.kumar@broadcom.com> 4.99.4-2
46 
+- Patched for CVE-2024-2397
45 47 
 * Thu May 18 2023 Nitesh Kumar <kunitesh@vmware.com> 4.99.4-1
46 48 
 - Upgrade to v4.99.4 to fix CVE-2023-1801
47 49 
 * Tue Apr 19 2022 Gerrit Photon <photon-checkins@vmware.com> 4.99.1-1