mirror of
https://git.yoctoproject.org/meta-security
synced 2026-01-11 15:00:34 +00:00
suricata: fix CVE-2024-45795 & CVE-2024-45796
* CVE-2024-45795 - Upstream-Status: Backport from72456d359b&&96d5c81aed* CVE-2024-45796 - Upstream-Status: Backport from9203656496Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
This commit is contained in:
Hitendra Prajapati
committed by
Scott Murray
Scott Murray
parent
0fbd550631
commit
27644f5474
123
recipes-ids/suricata/files/CVE-2024-45795.patch
Normal file
123
recipes-ids/suricata/files/CVE-2024-45795.patch
Normal file
@@ -0,0 +1,123 @@
|
||||
From 72456d359bf3064306b62024c809bb30b162f18c Mon Sep 17 00:00:00 2001
|
||||
From: Philippe Antoine <pantoine@oisf.net>
|
||||
Date: Mon, 12 Aug 2024 09:54:43 +0200
|
||||
Subject: [PATCH] detect/datasets: implement unset command
|
||||
|
||||
Ticket: 7195
|
||||
|
||||
Otherwise, Suricata aborted on such a rule
|
||||
|
||||
(cherry picked from commit e47598110a557bb9f87ea498d85ba91a45bb0cb6)
|
||||
|
||||
Upstream-Status: Backport [https://github.com/OISF/suricata/commit/72456d359bf3064306b62024c809bb30b162f18c && https://github.com/OISF/suricata/commit/96d5c81aed01f2bc0cd3e2e60057d0deb38caa99]
|
||||
CVE: CVE-2024-45795
|
||||
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
---
|
||||
doc/userguide/rules/datasets.rst | 2 +-
|
||||
src/datasets.c | 20 ++++++++++++++++++++
|
||||
src/datasets.h | 1 +
|
||||
src/detect-dataset.c | 11 +++++++++++
|
||||
src/detect-dataset.h | 5 -----
|
||||
5 files changed, 33 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/doc/userguide/rules/datasets.rst b/doc/userguide/rules/datasets.rst
|
||||
index 647b12e..dd9ecd2 100644
|
||||
--- a/doc/userguide/rules/datasets.rst
|
||||
+++ b/doc/userguide/rules/datasets.rst
|
||||
@@ -78,7 +78,7 @@ Syntax::
|
||||
|
||||
dataset:<cmd>,<name>,<options>;
|
||||
|
||||
- dataset:<set|isset|isnotset>,<name> \
|
||||
+ dataset:<set|unset|isset|isnotset>,<name> \
|
||||
[, type <string|md5|sha256|ipv4|ip>, save <file name>, load <file name>, state <file name>, memcap <size>, hashsize <size>];
|
||||
|
||||
type <type>
|
||||
diff --git a/src/datasets.c b/src/datasets.c
|
||||
index d89ed8d..32bcf6e 100644
|
||||
--- a/src/datasets.c
|
||||
+++ b/src/datasets.c
|
||||
@@ -1741,3 +1741,23 @@ int DatasetRemoveSerialized(Dataset *set, const char *string)
|
||||
return DatasetOpSerialized(set, string, DatasetRemoveString, DatasetRemoveMd5,
|
||||
DatasetRemoveSha256, DatasetRemoveIPv4, DatasetRemoveIPv6);
|
||||
}
|
||||
+
|
||||
+int DatasetRemove(Dataset *set, const uint8_t *data, const uint32_t data_len)
|
||||
+{
|
||||
+ if (set == NULL)
|
||||
+ return -1;
|
||||
+
|
||||
+ switch (set->type) {
|
||||
+ case DATASET_TYPE_STRING:
|
||||
+ return DatasetRemoveString(set, data, data_len);
|
||||
+ case DATASET_TYPE_MD5:
|
||||
+ return DatasetRemoveMd5(set, data, data_len);
|
||||
+ case DATASET_TYPE_SHA256:
|
||||
+ return DatasetRemoveSha256(set, data, data_len);
|
||||
+ case DATASET_TYPE_IPV4:
|
||||
+ return DatasetRemoveIPv4(set, data, data_len);
|
||||
+ case DATASET_TYPE_IPV6:
|
||||
+ return DatasetRemoveIPv6(set, data, data_len);
|
||||
+ }
|
||||
+ return -1;
|
||||
+}
|
||||
diff --git a/src/datasets.h b/src/datasets.h
|
||||
index af4fc17..0f28a9f 100644
|
||||
--- a/src/datasets.h
|
||||
+++ b/src/datasets.h
|
||||
@@ -56,6 +56,7 @@ Dataset *DatasetFind(const char *name, enum DatasetTypes type);
|
||||
Dataset *DatasetGet(const char *name, enum DatasetTypes type, const char *save, const char *load,
|
||||
uint64_t memcap, uint32_t hashsize);
|
||||
int DatasetAdd(Dataset *set, const uint8_t *data, const uint32_t data_len);
|
||||
+int DatasetRemove(Dataset *set, const uint8_t *data, const uint32_t data_len);
|
||||
int DatasetLookup(Dataset *set, const uint8_t *data, const uint32_t data_len);
|
||||
DataRepResultType DatasetLookupwRep(Dataset *set, const uint8_t *data, const uint32_t data_len,
|
||||
const DataRepType *rep);
|
||||
diff --git a/src/detect-dataset.c b/src/detect-dataset.c
|
||||
index 3d29646..aad5cf0 100644
|
||||
--- a/src/detect-dataset.c
|
||||
+++ b/src/detect-dataset.c
|
||||
@@ -41,6 +41,11 @@
|
||||
#include "util-path.h"
|
||||
#include "util-conf.h"
|
||||
|
||||
+#define DETECT_DATASET_CMD_SET 0
|
||||
+#define DETECT_DATASET_CMD_UNSET 1
|
||||
+#define DETECT_DATASET_CMD_ISNOTSET 2
|
||||
+#define DETECT_DATASET_CMD_ISSET 3
|
||||
+
|
||||
int DetectDatasetMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *,
|
||||
const Signature *, const SigMatchCtx *);
|
||||
static int DetectDatasetSetup (DetectEngineCtx *, Signature *, const char *);
|
||||
@@ -91,6 +96,12 @@ int DetectDatasetBufferMatch(DetectEngineThreadCtx *det_ctx,
|
||||
return 1;
|
||||
break;
|
||||
}
|
||||
+ case DETECT_DATASET_CMD_UNSET: {
|
||||
+ int r = DatasetRemove(sd->set, data, data_len);
|
||||
+ if (r == 1)
|
||||
+ return 1;
|
||||
+ break;
|
||||
+ }
|
||||
default:
|
||||
abort();
|
||||
}
|
||||
diff --git a/src/detect-dataset.h b/src/detect-dataset.h
|
||||
index ca83267..d243552 100644
|
||||
--- a/src/detect-dataset.h
|
||||
+++ b/src/detect-dataset.h
|
||||
@@ -26,11 +26,6 @@
|
||||
|
||||
#include "datasets.h"
|
||||
|
||||
-#define DETECT_DATASET_CMD_SET 0
|
||||
-#define DETECT_DATASET_CMD_UNSET 1
|
||||
-#define DETECT_DATASET_CMD_ISNOTSET 2
|
||||
-#define DETECT_DATASET_CMD_ISSET 3
|
||||
-
|
||||
typedef struct DetectDatasetData_ {
|
||||
Dataset *set;
|
||||
uint8_t cmd;
|
||||
--
|
||||
2.25.1
|
||||
|
||||
33
recipes-ids/suricata/files/CVE-2024-45796.patch
Normal file
33
recipes-ids/suricata/files/CVE-2024-45796.patch
Normal file
@@ -0,0 +1,33 @@
|
||||
From 9203656496c4081260817cce018a0d8fd57869b5 Mon Sep 17 00:00:00 2001
|
||||
From: Philippe Antoine <pantoine@oisf.net>
|
||||
Date: Mon, 15 Jul 2024 09:52:00 +0200
|
||||
Subject: [PATCH] defrag: fix off by one
|
||||
|
||||
Ticket: 7067
|
||||
|
||||
This off by one could lead to an empty fragment being inserted
|
||||
in the rb tree, which led to integer underflow.
|
||||
|
||||
Upstream-Status: Backport [https://github.com/OISF/suricata/commit/9203656496c4081260817cce018a0d8fd57869b5]
|
||||
CVE: CVE-2024-45796
|
||||
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
---
|
||||
src/defrag.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/defrag.c b/src/defrag.c
|
||||
index 71cf420..38704c9 100644
|
||||
--- a/src/defrag.c
|
||||
+++ b/src/defrag.c
|
||||
@@ -808,7 +808,7 @@ DefragInsertFrag(ThreadVars *tv, DecodeThreadVars *dtv, DefragTracker *tracker,
|
||||
}
|
||||
}
|
||||
|
||||
- if (ltrim > data_len) {
|
||||
+ if (ltrim >= data_len) {
|
||||
/* Full packet has been trimmed due to the overlap policy. Overlap
|
||||
* already set. */
|
||||
goto done;
|
||||
--
|
||||
2.25.1
|
||||
|
||||
@@ -16,6 +16,8 @@ SRC_URI += " \
|
||||
file://suricata.service \
|
||||
file://run-ptest \
|
||||
file://fixup.patch \
|
||||
file://CVE-2024-45795.patch \
|
||||
file://CVE-2024-45796.patch \
|
||||
"
|
||||
|
||||
inherit autotools pkgconfig python3native systemd ptest cargo cargo-update-recipe-crates
|
||||
|
||||
Reference in New Issue
Block a user