mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-07-16 16:27:27 +00:00
frr: fix CVE-2024-31949
CVE-2024-31949: In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a dynamic capability because malformed data results in a pointer not advancing. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-31949] [https://salsa.debian.org/lts-team/packages/frr/-/blob/debian/7.5.1-1.1+deb10u4/debian/patches/CVE-2024-31949.patch?ref_type=tags] Upstream patches: [https://github.com/FRRouting/frr/pull/15640/commits/30a332dad86fafd2b0b6c61d23de59ed969a219b] Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
This commit is contained in:
Zhang Peng
committed by
Gyorgy Sarvari
Gyorgy Sarvari
parent
d2da8450c0
commit
50c69deb2c
@@ -0,0 +1,153 @@
|
|||||||
|
From 54816c5b32e5318fbd1ff8335adf7e8dd93e2415 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Donatas Abraitis <donatas@opensourcerouting.org>
|
||||||
|
Date: Sat, 30 Mar 2024 15:35:18 +0200
|
||||||
|
Subject: [PATCH] bgpd: Fix errors handling for MP/GR capabilities as dynamic
|
||||||
|
capability
|
||||||
|
|
||||||
|
When receiving a MP/GR capability as dynamic capability, but malformed, do not
|
||||||
|
forget to advance the pointer to avoid hitting infinity loop.
|
||||||
|
|
||||||
|
After:
|
||||||
|
```
|
||||||
|
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [GS0AQ-HKY0X] 127.0.0.1 rcv CAPABILITY
|
||||||
|
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 5, length 0
|
||||||
|
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 0, length 0
|
||||||
|
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [HFHDS-QT71N][EC 33554494] 127.0.0.1(donatas-pc): unrecognized capability code: 0 - ignored
|
||||||
|
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 0, code: 0, length 0
|
||||||
|
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [HFHDS-QT71N][EC 33554494] 127.0.0.1(donatas-pc): unrecognized capability code: 0 - ignored
|
||||||
|
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 0, code: 0, length 0
|
||||||
|
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [HFHDS-QT71N][EC 33554494] 127.0.0.1(donatas-pc): unrecognized capability code: 0 - ignored
|
||||||
|
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 0, code: 0, length 1
|
||||||
|
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [HFHDS-QT71N][EC 33554494] 127.0.0.1(donatas-pc): unrecognized capability code: 0 - ignored
|
||||||
|
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||||
|
Mar 29 11:15:28 donatas-laptop bgpd[353550]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||||
|
```
|
||||||
|
|
||||||
|
Before:
|
||||||
|
```
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [Z1DRQ-N6Z5F] 127.0.0.1(donatas-pc): Dynamic Capability MultiProtocol Extensions afi/safi invalid (bad-value/unicast)
|
||||||
|
Mar 29 11:14:54 donatas-laptop bgpd[347675]: [JTVED-VGTQQ] 127.0.0.1(donatas-pc): CAPABILITY has action: 1, code: 1, length 10
|
||||||
|
```
|
||||||
|
|
||||||
|
Reported-by: Iggy Frankovic <iggyfran@amazon.com>
|
||||||
|
Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
|
||||||
|
|
||||||
|
CVE: CVE-2024-31949
|
||||||
|
Upstream-Status: Backport [https://github.com/FRRouting/frr/commit/30a332dad86fafd2b0b6c61d23de59ed969a219b]
|
||||||
|
Ref debian fix: [https://salsa.debian.org/lts-team/packages/frr/-/blob/debian/7.5.1-1.1+deb10u4/debian/patches/CVE-2024-31949.patch?ref_type=tags]
|
||||||
|
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
|
||||||
|
---
|
||||||
|
bgpd/bgp_packet.c | 14 +++++++++-----
|
||||||
|
1 file changed, 9 insertions(+), 5 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/bgpd/bgp_packet.c b/bgpd/bgp_packet.c
|
||||||
|
index bcd47e32d4..361cd7b6e1 100644
|
||||||
|
--- a/bgpd/bgp_packet.c
|
||||||
|
+++ b/bgpd/bgp_packet.c
|
||||||
|
@@ -2420,6 +2420,7 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
|
||||||
|
zlog_info("%s Capability length error", peer->host);
|
||||||
|
bgp_notify_send(peer, BGP_NOTIFY_CEASE,
|
||||||
|
BGP_NOTIFY_SUBCODE_UNSPECIFIC);
|
||||||
|
+ pnt += length;
|
||||||
|
return BGP_Stop;
|
||||||
|
}
|
||||||
|
action = *pnt;
|
||||||
|
@@ -2432,7 +2433,7 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
|
||||||
|
peer->host, action);
|
||||||
|
bgp_notify_send(peer, BGP_NOTIFY_CEASE,
|
||||||
|
BGP_NOTIFY_SUBCODE_UNSPECIFIC);
|
||||||
|
- return BGP_Stop;
|
||||||
|
+ goto done;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (bgp_debug_neighbor_events(peer))
|
||||||
|
@@ -2445,6 +2446,7 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
|
||||||
|
"%s Capability structure is not properly filled out, expected at least %zu bytes but header length specified is %d",
|
||||||
|
peer->host, sizeof(struct capability_mp_data),
|
||||||
|
hdr->length);
|
||||||
|
+ pnt += length;
|
||||||
|
return BGP_Stop;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -2453,12 +2455,12 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
|
||||||
|
zlog_info("%s Capability length error", peer->host);
|
||||||
|
bgp_notify_send(peer, BGP_NOTIFY_CEASE,
|
||||||
|
BGP_NOTIFY_SUBCODE_UNSPECIFIC);
|
||||||
|
+ pnt += length;
|
||||||
|
return BGP_Stop;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Fetch structure to the byte stream. */
|
||||||
|
memcpy(&mpc, pnt + 3, sizeof(struct capability_mp_data));
|
||||||
|
- pnt += hdr->length + 3;
|
||||||
|
|
||||||
|
/* We know MP Capability Code. */
|
||||||
|
if (hdr->code == CAPABILITY_CODE_MP) {
|
||||||
|
@@ -2468,7 +2470,7 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
|
||||||
|
/* Ignore capability when override-capability is set. */
|
||||||
|
if (CHECK_FLAG(peer->flags,
|
||||||
|
PEER_FLAG_OVERRIDE_CAPABILITY))
|
||||||
|
- continue;
|
||||||
|
+ goto done;
|
||||||
|
|
||||||
|
/* Convert AFI, SAFI to internal values. */
|
||||||
|
if (bgp_map_afi_safi_iana2int(pkt_afi, pkt_safi, &afi,
|
||||||
|
@@ -2479,7 +2481,7 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
|
||||||
|
peer->host,
|
||||||
|
iana_afi2str(pkt_afi),
|
||||||
|
iana_safi2str(pkt_safi));
|
||||||
|
- continue;
|
||||||
|
+ goto done;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Address family check. */
|
||||||
|
@@ -2507,7 +2509,7 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
|
||||||
|
if (peer_active_nego(peer))
|
||||||
|
bgp_clear_route(peer, afi, safi);
|
||||||
|
else
|
||||||
|
- return BGP_Stop;
|
||||||
|
+ goto done;
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
flog_warn(
|
||||||
|
@@ -2515,6 +2517,8 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
|
||||||
|
"%s unrecognized capability code: %d - ignored",
|
||||||
|
peer->host, hdr->code);
|
||||||
|
}
|
||||||
|
+done:
|
||||||
|
+ pnt += hdr->length + 3;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* No FSM action necessary */
|
||||||
|
--
|
||||||
|
2.34.1
|
||||||
|
|
||||||
@@ -35,6 +35,7 @@ SRC_URI = "git://github.com/FRRouting/frr.git;protocol=https;branch=stable/8.2 \
|
|||||||
file://CVE-2024-31951.patch \
|
file://CVE-2024-31951.patch \
|
||||||
file://CVE-2024-31948.patch \
|
file://CVE-2024-31948.patch \
|
||||||
file://CVE-2024-55553.patch \
|
file://CVE-2024-55553.patch \
|
||||||
|
file://CVE-2024-31949.patch \
|
||||||
"
|
"
|
||||||
|
|
||||||
SRCREV = "79188bf710e92acf42fb5b9b0a2e9593a5ee9b05"
|
SRCREV = "79188bf710e92acf42fb5b9b0a2e9593a5ee9b05"
|
||||||
|
|||||||
Reference in New Issue
Block a user