<div dir="ltr">This is now in master, will you also submit backports for the stable branches?<div><br></div><div>Ross</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 21 August 2017 at 13:05, Sona Sarmadi <span dir="ltr"><<a href="mailto:sona.sarmadi@enea.com" target="_blank">sona.sarmadi@enea.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">dnsproxy: Fix crash on malformed DNS response<br>
If the response query string is malformed, we might access memory<br>
pass the end of "name" variable in parse_response().<br>
<br>
[YOCTO #11959]<br>
<br>
Signed-off-by: Sona Sarmadi <<a href="mailto:sona.sarmadi@enea.com">sona.sarmadi@enea.com</a>><br>
---<br>
.../connman/connman/CVE-2017-<wbr>12865.patch | 87 ++++++++++++++++++++++<br>
meta/recipes-connectivity/<wbr>connman/<a href="http://connman_1.34.bb" rel="noreferrer" target="_blank">connman_1.34.bb</a> | 1 +<br>
2 files changed, 88 insertions(+)<br>
create mode 100644 meta/recipes-connectivity/<wbr>connman/connman/CVE-2017-<wbr>12865.patch<br>
<br>
diff --git a/meta/recipes-connectivity/<wbr>connman/connman/CVE-2017-<wbr>12865.patch b/meta/recipes-connectivity/<wbr>connman/connman/CVE-2017-<wbr>12865.patch<br>
new file mode 100644<br>
index 0000000..45f78f1<br>
--- /dev/null<br>
+++ b/meta/recipes-connectivity/<wbr>connman/connman/CVE-2017-<wbr>12865.patch<br>
@@ -0,0 +1,87 @@<br>
+From 5c281d182ecdd0a424b64f7698f324<wbr>67f8f67b71 Mon Sep 17 00:00:00 2001<br>
+From: Jukka Rissanen <<a href="mailto:jukka.rissanen@linux.intel.com">jukka.rissanen@linux.intel.<wbr>com</a>><br>
+Date: Wed, 9 Aug 2017 10:16:46 +0300<br>
+Subject: dnsproxy: Fix crash on malformed DNS response<br>
+<br>
+If the response query string is malformed, we might access memory<br>
+pass the end of "name" variable in parse_response().<br>
+<br>
+CVE: CVE-2017-12865<br>
+Upstream-Status: Backport [<a href="https://git.kernel.org/pub/scm/network/connman/connman.git/patch/?id=5c281d182ecdd0a424b64f7698f32467f8f67b71" rel="noreferrer" target="_blank">https://git.kernel.org/pub/<wbr>scm/network/connman/connman.<wbr>git/patch/?id=<wbr>5c281d182ecdd0a424b64f7698f324<wbr>67f8f67b71</a>]<br>
+<br>
+Signed-off-by: Sona Sarmadi <<a href="mailto:sona.sarmadi@enea.com">sona.sarmadi@enea.com</a>><br>
+---<br>
+ src/dnsproxy.c | 16 ++++++++++------<br>
+ 1 file changed, 10 insertions(+), 6 deletions(-)<br>
+<br>
+diff --git a/src/dnsproxy.c b/src/dnsproxy.c<br>
+index 38ac5bf..40b4f15 100644<br>
+--- a/src/dnsproxy.c<br>
++++ b/src/dnsproxy.c<br>
+@@ -838,7 +838,7 @@ static struct cache_entry *cache_check(gpointer request, int *qtype, int proto)<br>
+ static int get_name(int counter,<br>
+ unsigned char *pkt, unsigned char *start, unsigned char *max,<br>
+ unsigned char *output, int output_max, int *output_len,<br>
+- unsigned char **end, char *name, int *name_len)<br>
++ unsigned char **end, char *name, size_t max_name, int *name_len)<br>
+ {<br>
+ unsigned char *p;<br>
+<br>
+@@ -859,7 +859,7 @@ static int get_name(int counter,<br>
+<br>
+ return get_name(counter + 1, pkt, pkt + offset, max,<br>
+ output, output_max, output_len, end,<br>
+- name, name_len);<br>
++ name, max_name, name_len);<br>
+ } else {<br>
+ unsigned label_len = *p;<br>
+<br>
+@@ -869,6 +869,9 @@ static int get_name(int counter,<br>
+ if (*output_len > output_max)<br>
+ return -ENOBUFS;<br>
+<br>
++ if ((*name_len + 1 + label_len + 1) > max_name)<br>
++ return -ENOBUFS;<br>
++<br>
+ /*<br>
+ * We need the original name in order to check<br>
+ * if this answer is the correct one.<br>
+@@ -900,14 +903,14 @@ static int parse_rr(unsigned char *buf, unsigned char *start,<br>
+ unsigned char *response, unsigned int *response_size,<br>
+ uint16_t *type, uint16_t *class, int *ttl, int *rdlen,<br>
+ unsigned char **end,<br>
+- char *name)<br>
++ char *name, size_t max_name)<br>
+ {<br>
+ struct domain_rr *rr;<br>
+ int err, offset;<br>
+ int name_len = 0, output_len = 0, max_rsp = *response_size;<br>
+<br>
+ err = get_name(0, buf, start, max, response, max_rsp,<br>
+- &output_len, end, name, &name_len);<br>
++ &output_len, end, name, max_name, &name_len);<br>
+ if (err < 0)<br>
+ return err;<br>
+<br>
+@@ -1033,7 +1036,8 @@ static int parse_response(unsigned char *buf, int buflen,<br>
+ memset(rsp, 0, sizeof(rsp));<br>
+<br>
+ ret = parse_rr(buf, ptr, buf + buflen, rsp, &rsp_len,<br>
+- type, class, ttl, &rdlen, &next, name);<br>
++ type, class, ttl, &rdlen, &next, name,<br>
++ sizeof(name) - 1);<br>
+ if (ret != 0) {<br>
+ err = ret;<br>
+ goto out;<br>
+@@ -1099,7 +1103,7 @@ static int parse_response(unsigned char *buf, int buflen,<br>
+ */<br>
+ ret = get_name(0, buf, next - rdlen, buf + buflen,<br>
+ rsp, rsp_len, &output_len, &end,<br>
+- name, &name_len);<br>
++ name, sizeof(name) - 1, &name_len);<br>
+ if (ret != 0) {<br>
+ /* just ignore the error at this point */<br>
+ ptr = next;<br>
+--<br>
+cgit v1.1<br>
+<br>
diff --git a/meta/recipes-connectivity/<wbr>connman/<a href="http://connman_1.34.bb" rel="noreferrer" target="_blank">connman_1.34.bb</a> b/meta/recipes-connectivity/<wbr>connman/<a href="http://connman_1.34.bb" rel="noreferrer" target="_blank">connman_1.34.bb</a><br>
index 868f940..dc2c688 100644<br>
--- a/meta/recipes-connectivity/<wbr>connman/<a href="http://connman_1.34.bb" rel="noreferrer" target="_blank">connman_1.34.bb</a><br>
+++ b/meta/recipes-connectivity/<wbr>connman/<a href="http://connman_1.34.bb" rel="noreferrer" target="_blank">connman_1.34.bb</a><br>
@@ -7,6 +7,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/<wbr>network/${BPN}/${BP}.tar.xz \<br>
file://connman \<br>
file://no-version-scripts.<wbr>patch \<br>
file://includes.patch \<br>
+ file://CVE-2017-12865.patch \<br>
"<br>
SRC_URI_append_libc-musl = " file://0002-resolve-musl-does-<wbr>not-implement-res_ninit.patch \<br>
"<br>
<span class="HOEnZb"><font color="#888888">--<br>
1.9.1<br>
<br>
--<br>
______________________________<wbr>_________________<br>
Openembedded-core mailing list<br>
<a href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.<wbr>openembedded.org</a><br>
<a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" rel="noreferrer" target="_blank">http://lists.openembedded.org/<wbr>mailman/listinfo/openembedded-<wbr>core</a><br>
</font></span></blockquote></div><br></div>