[meta-networking][dunfell][PATCH ] dnsmasq: Fix CVE-2022-0934

* [meta-networking][dunfell][PATCH ] dnsmasq: Fix CVE-2022-0934
@ 2022-09-21 10:04 Virendra Thakur
       [not found] ` <ff26c94d-dbf0-f67c-a200-b2f2a641aba2@gmail.com>
  0 siblings, 1 reply; 2+ messages in thread
From: Virendra Thakur @ 2022-09-21 10:04 UTC (permalink / raw)
  To: openembedded-devel; +Cc: akuster808, Virendra Thakur

From: Virendra Thakur <virendrak@kpit.com>

Add patch to fix CVE-2022-0934

Link: https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=patch;h=03345ecefeb0d82e3c3a4c28f27c3554f0611b39

Signed-off-by: Virendra Thakur <virendrak@kpit.com>
---
 .../recipes-support/dnsmasq/dnsmasq_2.81.bb   |   1 +
 .../dnsmasq/files/CVE-2022-0934.patch         | 188 ++++++++++++++++++
 2 files changed, 189 insertions(+)
 create mode 100644 meta-networking/recipes-support/dnsmasq/files/CVE-2022-0934.patch

diff --git a/meta-networking/recipes-support/dnsmasq/dnsmasq_2.81.bb b/meta-networking/recipes-support/dnsmasq/dnsmasq_2.81.bb
index 2fb389915..8db57edb7 100644
--- a/meta-networking/recipes-support/dnsmasq/dnsmasq_2.81.bb
+++ b/meta-networking/recipes-support/dnsmasq/dnsmasq_2.81.bb
@@ -11,4 +11,5 @@ SRC_URI += "\
     file://CVE-2020-25686-1.patch \
     file://CVE-2020-25686-2.patch \
     file://CVE-2021-3448.patch \
+    file://CVE-2022-0934.patch \
 "
diff --git a/meta-networking/recipes-support/dnsmasq/files/CVE-2022-0934.patch b/meta-networking/recipes-support/dnsmasq/files/CVE-2022-0934.patch
new file mode 100644
index 000000000..f14fc358b
--- /dev/null
+++ b/meta-networking/recipes-support/dnsmasq/files/CVE-2022-0934.patch
@@ -0,0 +1,188 @@
+From 03345ecefeb0d82e3c3a4c28f27c3554f0611b39 Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Thu, 31 Mar 2022 21:35:20 +0100
+Subject: [PATCH] Fix write-after-free error in DHCPv6 code. CVE-2022-0934
+ refers.
+
+Upstream-Status: Backport [https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=patch;h=03345ecefeb0d82e3c3a4c28f27c3554f0611b39]
+CVE: CVE-2022-0934
+Comment: Hunk from CHANGELOG and rfc3315.c are refresh base on dnsmasq 2.81 version
+Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
+---
+Index: dnsmasq-2.81/CHANGELOG
+===================================================================
+--- dnsmasq-2.81.orig/CHANGELOG
++++ dnsmasq-2.81/CHANGELOG
+@@ -88,6 +88,9 @@ version 2.81
+
+       Add --script-on-renewal option.
+
++      Fix write-after-free error in DHCPv6 server code.
++      CVE-2022-0934 refers.
++
+
+ version 2.80
+       Add support for RFC 4039 DHCP rapid commit. Thanks to Ashram Method
+Index: dnsmasq-2.81/src/rfc3315.c
+===================================================================
+--- dnsmasq-2.81.orig/src/rfc3315.c
++++ dnsmasq-2.81/src/rfc3315.c
+@@ -33,9 +33,9 @@ struct state {
+   unsigned int mac_len, mac_type;
+ };
+
+-static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,
++static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz,
+                            struct in6_addr *client_addr, int is_unicast, time_t now);
+-static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now);
++static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now);
+ static void log6_opts(int nest, unsigned int xid, void *start_opts, void *end_opts);
+ static void log6_packet(struct state *state, char *type, struct in6_addr *addr, char *string);
+ static void log6_quiet(struct state *state, char *type, struct in6_addr *addr, char *string);
+@@ -104,12 +104,12 @@ unsigned short dhcp6_reply(struct dhcp_c
+ }
+
+ /* This cost me blood to write, it will probably cost you blood to understand - srk. */
+-static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,
++static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz,
+                            struct in6_addr *client_addr, int is_unicast, time_t now)
+ {
+   void *end = inbuff + sz;
+   void *opts = inbuff + 34;
+-  int msg_type = *((unsigned char *)inbuff);
++  int msg_type = *inbuff;
+   unsigned char *outmsgtypep;
+   void *opt;
+   struct dhcp_vendor *vendor;
+@@ -259,15 +259,15 @@ static int dhcp6_maybe_relay(struct stat
+   return 1;
+ }
+
+-static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now)
++static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now)
+ {
+   void *opt;
+-  int i, o, o1, start_opts;
++  int i, o, o1, start_opts, start_msg;
+   struct dhcp_opt *opt_cfg;
+   struct dhcp_netid *tagif;
+   struct dhcp_config *config = NULL;
+   struct dhcp_netid known_id, iface_id, v6_id;
+-  unsigned char *outmsgtypep;
++  unsigned char outmsgtype;
+   struct dhcp_vendor *vendor;
+   struct dhcp_context *context_tmp;
+   struct dhcp_mac *mac_opt;
+@@ -296,12 +296,13 @@ static int dhcp6_no_relay(struct state *
+   v6_id.next = state->tags;
+   state->tags = &v6_id;
+
+-  /* copy over transaction-id, and save pointer to message type */
+-  if (!(outmsgtypep = put_opt6(inbuff, 4)))
++  start_msg = save_counter(-1);
++  /* copy over transaction-id */
++  if (!put_opt6(inbuff, 4))
+     return 0;
+   start_opts = save_counter(-1);
+-  state->xid = outmsgtypep[3] | outmsgtypep[2] << 8 | outmsgtypep[1] << 16;
+-
++  state->xid = inbuff[3] | inbuff[2] << 8 | inbuff[1] << 16;
++
+   /* We're going to be linking tags from all context we use.
+      mark them as unused so we don't link one twice and break the list */
+   for (context_tmp = state->context; context_tmp; context_tmp = context_tmp->current)
+@@ -347,7 +348,7 @@ static int dhcp6_no_relay(struct state *
+       (msg_type == DHCP6REQUEST || msg_type == DHCP6RENEW || msg_type == DHCP6RELEASE || msg_type == DHCP6DECLINE))
+
+     {
+-      *outmsgtypep = DHCP6REPLY;
++      outmsgtype = DHCP6REPLY;
+       o1 = new_opt6(OPTION6_STATUS_CODE);
+       put_opt6_short(DHCP6USEMULTI);
+       put_opt6_string("Use multicast");
+@@ -619,11 +620,11 @@ static int dhcp6_no_relay(struct state *
+       struct dhcp_netid *solicit_tags;
+       struct dhcp_context *c;
+
+-      *outmsgtypep = DHCP6ADVERTISE;
++      outmsgtype = DHCP6ADVERTISE;
+
+       if (opt6_find(state->packet_options, state->end, OPTION6_RAPID_COMMIT, 0))
+         {
+-          *outmsgtypep = DHCP6REPLY;
++          outmsgtype = DHCP6REPLY;
+           state->lease_allocate = 1;
+           o = new_opt6(OPTION6_RAPID_COMMIT);
+           end_opt6(o);
+@@ -809,7 +810,7 @@ static int dhcp6_no_relay(struct state *
+       int start = save_counter(-1);
+
+       /* set reply message type */
+-      *outmsgtypep = DHCP6REPLY;
++      outmsgtype = DHCP6REPLY;
+       state->lease_allocate = 1;
+
+       log6_quiet(state, "DHCPREQUEST", NULL, ignore ? _("ignored") : NULL);
+@@ -921,7 +922,7 @@ static int dhcp6_no_relay(struct state *
+     case DHCP6RENEW:
+       {
+       /* set reply message type */
+-      *outmsgtypep = DHCP6REPLY;
++      outmsgtype = DHCP6REPLY;
+
+       log6_quiet(state, "DHCPRENEW", NULL, NULL);
+
+@@ -1033,7 +1034,7 @@ static int dhcp6_no_relay(struct state *
+       int good_addr = 0;
+
+       /* set reply message type */
+-      *outmsgtypep = DHCP6REPLY;
++      outmsgtype = DHCP6REPLY;
+
+       log6_quiet(state, "DHCPCONFIRM", NULL, NULL);
+
+@@ -1097,7 +1098,7 @@ static int dhcp6_no_relay(struct state *
+       log6_quiet(state, "DHCPINFORMATION-REQUEST", NULL, ignore ? _("ignored") : state->hostname);
+       if (ignore)
+         return 0;
+-      *outmsgtypep = DHCP6REPLY;
++      outmsgtype = DHCP6REPLY;
+       tagif = add_options(state, 1);
+       break;
+       }
+@@ -1106,7 +1107,7 @@ static int dhcp6_no_relay(struct state *
+     case DHCP6RELEASE:
+       {
+       /* set reply message type */
+-      *outmsgtypep = DHCP6REPLY;
++      outmsgtype = DHCP6REPLY;
+
+       log6_quiet(state, "DHCPRELEASE", NULL, NULL);
+
+@@ -1171,7 +1172,7 @@ static int dhcp6_no_relay(struct state *
+     case DHCP6DECLINE:
+       {
+       /* set reply message type */
+-      *outmsgtypep = DHCP6REPLY;
++      outmsgtype = DHCP6REPLY;
+
+       log6_quiet(state, "DHCPDECLINE", NULL, NULL);
+
+@@ -1251,10 +1252,15 @@ static int dhcp6_no_relay(struct state *
+       }
+
+     }
+-
++
++  /* Fill in the message type. Note that we store the offset,
++     not a direct pointer, since the packet memory may have been
++     reallocated. */
++  ((unsigned char *)(daemon->outpacket.iov_base))[start_msg] = outmsgtype;
++
+   log_tags(tagif, state->xid);
+   log6_opts(0, state->xid, daemon->outpacket.iov_base + start_opts, daemon->outpacket.iov_base + save_counter(-1));
+-
++
+   return 1;
+
+ }
--
2.17.1

This message contains information that may be privileged or confidential and is the property of the KPIT Technologies Ltd. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message. KPIT Technologies Ltd. does not accept any liability for virus infected mails.


^ permalink raw reply related	[flat|nested] 2+ messages in thread