From 27644f5474a81381bbb71e0f70029775df70f786 Mon Sep 17 00:00:00 2001 From: Hitendra Prajapati Date: Thu, 21 Nov 2024 12:31:07 +0530 Subject: [PATCH] suricata: fix CVE-2024-45795 & CVE-2024-45796 * CVE-2024-45795 - Upstream-Status: Backport from https://github.com/OISF/suricata/commit/72456d359bf3064306b62024c809bb30b162f18c && https://github.com/OISF/suricata/commit/96d5c81aed01f2bc0cd3e2e60057d0deb38caa99 * CVE-2024-45796 - Upstream-Status: Backport from https://github.com/OISF/suricata/commit/9203656496c4081260817cce018a0d8fd57869b5 Signed-off-by: Hitendra Prajapati Signed-off-by: Scott Murray --- .../suricata/files/CVE-2024-45795.patch | 123 ++++++++++++++++++ .../suricata/files/CVE-2024-45796.patch | 33 +++++ recipes-ids/suricata/suricata_7.0.0.bb | 2 + 3 files changed, 158 insertions(+) create mode 100644 recipes-ids/suricata/files/CVE-2024-45795.patch create mode 100644 recipes-ids/suricata/files/CVE-2024-45796.patch diff --git a/recipes-ids/suricata/files/CVE-2024-45795.patch b/recipes-ids/suricata/files/CVE-2024-45795.patch new file mode 100644 index 0000000..10363c5 --- /dev/null +++ b/recipes-ids/suricata/files/CVE-2024-45795.patch @@ -0,0 +1,123 @@ +From 72456d359bf3064306b62024c809bb30b162f18c Mon Sep 17 00:00:00 2001 +From: Philippe Antoine +Date: Mon, 12 Aug 2024 09:54:43 +0200 +Subject: [PATCH] detect/datasets: implement unset command + +Ticket: 7195 + +Otherwise, Suricata aborted on such a rule + +(cherry picked from commit e47598110a557bb9f87ea498d85ba91a45bb0cb6) + +Upstream-Status: Backport [https://github.com/OISF/suricata/commit/72456d359bf3064306b62024c809bb30b162f18c && https://github.com/OISF/suricata/commit/96d5c81aed01f2bc0cd3e2e60057d0deb38caa99] +CVE: CVE-2024-45795 +Signed-off-by: Hitendra Prajapati +--- + doc/userguide/rules/datasets.rst | 2 +- + src/datasets.c | 20 ++++++++++++++++++++ + src/datasets.h | 1 + + src/detect-dataset.c | 11 +++++++++++ + src/detect-dataset.h | 5 ----- + 5 files changed, 33 insertions(+), 6 deletions(-) + +diff --git a/doc/userguide/rules/datasets.rst b/doc/userguide/rules/datasets.rst +index 647b12e..dd9ecd2 100644 +--- a/doc/userguide/rules/datasets.rst ++++ b/doc/userguide/rules/datasets.rst +@@ -78,7 +78,7 @@ Syntax:: + + dataset:,,; + +- dataset:, \ ++ dataset:, \ + [, type , save , load , state , memcap , hashsize ]; + + type +diff --git a/src/datasets.c b/src/datasets.c +index d89ed8d..32bcf6e 100644 +--- a/src/datasets.c ++++ b/src/datasets.c +@@ -1741,3 +1741,23 @@ int DatasetRemoveSerialized(Dataset *set, const char *string) + return DatasetOpSerialized(set, string, DatasetRemoveString, DatasetRemoveMd5, + DatasetRemoveSha256, DatasetRemoveIPv4, DatasetRemoveIPv6); + } ++ ++int DatasetRemove(Dataset *set, const uint8_t *data, const uint32_t data_len) ++{ ++ if (set == NULL) ++ return -1; ++ ++ switch (set->type) { ++ case DATASET_TYPE_STRING: ++ return DatasetRemoveString(set, data, data_len); ++ case DATASET_TYPE_MD5: ++ return DatasetRemoveMd5(set, data, data_len); ++ case DATASET_TYPE_SHA256: ++ return DatasetRemoveSha256(set, data, data_len); ++ case DATASET_TYPE_IPV4: ++ return DatasetRemoveIPv4(set, data, data_len); ++ case DATASET_TYPE_IPV6: ++ return DatasetRemoveIPv6(set, data, data_len); ++ } ++ return -1; ++} +diff --git a/src/datasets.h b/src/datasets.h +index af4fc17..0f28a9f 100644 +--- a/src/datasets.h ++++ b/src/datasets.h +@@ -56,6 +56,7 @@ Dataset *DatasetFind(const char *name, enum DatasetTypes type); + Dataset *DatasetGet(const char *name, enum DatasetTypes type, const char *save, const char *load, + uint64_t memcap, uint32_t hashsize); + int DatasetAdd(Dataset *set, const uint8_t *data, const uint32_t data_len); ++int DatasetRemove(Dataset *set, const uint8_t *data, const uint32_t data_len); + int DatasetLookup(Dataset *set, const uint8_t *data, const uint32_t data_len); + DataRepResultType DatasetLookupwRep(Dataset *set, const uint8_t *data, const uint32_t data_len, + const DataRepType *rep); +diff --git a/src/detect-dataset.c b/src/detect-dataset.c +index 3d29646..aad5cf0 100644 +--- a/src/detect-dataset.c ++++ b/src/detect-dataset.c +@@ -41,6 +41,11 @@ + #include "util-path.h" + #include "util-conf.h" + ++#define DETECT_DATASET_CMD_SET 0 ++#define DETECT_DATASET_CMD_UNSET 1 ++#define DETECT_DATASET_CMD_ISNOTSET 2 ++#define DETECT_DATASET_CMD_ISSET 3 ++ + int DetectDatasetMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, + const Signature *, const SigMatchCtx *); + static int DetectDatasetSetup (DetectEngineCtx *, Signature *, const char *); +@@ -91,6 +96,12 @@ int DetectDatasetBufferMatch(DetectEngineThreadCtx *det_ctx, + return 1; + break; + } ++ case DETECT_DATASET_CMD_UNSET: { ++ int r = DatasetRemove(sd->set, data, data_len); ++ if (r == 1) ++ return 1; ++ break; ++ } + default: + abort(); + } +diff --git a/src/detect-dataset.h b/src/detect-dataset.h +index ca83267..d243552 100644 +--- a/src/detect-dataset.h ++++ b/src/detect-dataset.h +@@ -26,11 +26,6 @@ + + #include "datasets.h" + +-#define DETECT_DATASET_CMD_SET 0 +-#define DETECT_DATASET_CMD_UNSET 1 +-#define DETECT_DATASET_CMD_ISNOTSET 2 +-#define DETECT_DATASET_CMD_ISSET 3 +- + typedef struct DetectDatasetData_ { + Dataset *set; + uint8_t cmd; +-- +2.25.1 + diff --git a/recipes-ids/suricata/files/CVE-2024-45796.patch b/recipes-ids/suricata/files/CVE-2024-45796.patch new file mode 100644 index 0000000..ae00a5f --- /dev/null +++ b/recipes-ids/suricata/files/CVE-2024-45796.patch @@ -0,0 +1,33 @@ +From 9203656496c4081260817cce018a0d8fd57869b5 Mon Sep 17 00:00:00 2001 +From: Philippe Antoine +Date: Mon, 15 Jul 2024 09:52:00 +0200 +Subject: [PATCH] defrag: fix off by one + +Ticket: 7067 + +This off by one could lead to an empty fragment being inserted +in the rb tree, which led to integer underflow. + +Upstream-Status: Backport [https://github.com/OISF/suricata/commit/9203656496c4081260817cce018a0d8fd57869b5] +CVE: CVE-2024-45796 +Signed-off-by: Hitendra Prajapati +--- + src/defrag.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/defrag.c b/src/defrag.c +index 71cf420..38704c9 100644 +--- a/src/defrag.c ++++ b/src/defrag.c +@@ -808,7 +808,7 @@ DefragInsertFrag(ThreadVars *tv, DecodeThreadVars *dtv, DefragTracker *tracker, + } + } + +- if (ltrim > data_len) { ++ if (ltrim >= data_len) { + /* Full packet has been trimmed due to the overlap policy. Overlap + * already set. */ + goto done; +-- +2.25.1 + diff --git a/recipes-ids/suricata/suricata_7.0.0.bb b/recipes-ids/suricata/suricata_7.0.0.bb index a01b3d9..e5d6ed1 100644 --- a/recipes-ids/suricata/suricata_7.0.0.bb +++ b/recipes-ids/suricata/suricata_7.0.0.bb @@ -16,6 +16,8 @@ SRC_URI += " \ file://suricata.service \ file://run-ptest \ file://fixup.patch \ + file://CVE-2024-45795.patch \ + file://CVE-2024-45796.patch \ " inherit autotools pkgconfig python3native systemd ptest cargo cargo-update-recipe-crates