CVE-2017-13046: Out-of-bounds Read (CWE-125)
value: The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:bgp_attr_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-bgp.c, tests/TESTLIST, tests/bgp_pmsi_tunnel-oobr.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13046/BGP: fix an existing bounds check for PMSI Tunnel

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s).

Diff: diff --git a/print-bgp.c b/print-bgp.c
index 04f0c3fa56..d7a336a460 100644
--- a/print-bgp.c
+++ b/print-bgp.c
@@ -2121,15 +2121,15 @@ bgp_attr_print(netdissect_options *ndo,
 
         case BGPTYPE_PMSI_TUNNEL:
         {
                 uint8_t tunnel_type, flags;
 
+                ND_TCHECK2(tptr[0], 5);
                 tunnel_type = *(tptr+1);
                 flags = *tptr;
                 tlen = len;
 
-                ND_TCHECK2(tptr[0], 5);
                 ND_PRINT((ndo, "\n\t    Tunnel-type %s (%u), Flags [%s], MPLS Label %u",
                        tok2str(bgp_pmsi_tunnel_values, "Unknown", tunnel_type),
                        tunnel_type,
                        bittok2str(bgp_pmsi_flag_values, "none", flags),
                        EXTRACT_24BITS(tptr+2)>>4));
diff --git a/tests/TESTLIST b/tests/TESTLIST
index 687e92f378..7532e24031 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -561,10 +561,11 @@ isakmpv1-attr-oobr	isakmpv1-attr-oobr.pcap		isakmpv1-attr-oobr.out	-v
 # The .pcap file is truncated after the 1st packet.
 hncp_dhcpv6data-oobr	hncp_dhcpv6data-oobr.pcap	hncp_dhcpv6data-oobr.out -v -c1
 # Same comments apply to the case below.
 hncp_dhcpv4data-oobr	hncp_dhcpv4data-oobr.pcap	hncp_dhcpv4data-oobr.out -v -c1
 vqp-oobr		vqp-oobr.pcap			vqp-oobr.out		-v -c1
+bgp_pmsi_tunnel-oobr	bgp_pmsi_tunnel-oobr.pcap	bgp_pmsi_tunnel-oobr.out -v -c1
 
 # bad packets from Katie Holly
 mlppp-oobr		mlppp-oobr.pcap			mlppp-oobr.out
 
 # bad packets from Kim Gwan Yeong
diff --git a/tests/bgp_pmsi_tunnel-oobr.out b/tests/bgp_pmsi_tunnel-oobr.out
new file mode 100644
index 0000000000..3b73c7a645
--- /dev/null
+++ b/tests/bgp_pmsi_tunnel-oobr.out
@@ -0,0 +1,11 @@
+IP (tos 0x0, ttl 254, id 40207, offset 0, flags [+, DF, rsvd], proto TCP (6), length 296, bad cksum 8e15 (->3eaa)!)
+    241.0.32.19.179 > 239.0.0.1.0: Flags [none], seq 2146695561:2146695813, win 56026, options [unknown-161,eol], length 252: BGP
+	Update Message (2), length: 45
+	  Withdrawn routes: 3 bytes
+	  Attribute Set (128), length: 7, Flags [OTPE+f]: 
+	    Origin AS: 4067
+	      Origin (1), length: 1EGP
+	      Unknown Attribute (19), length: 1, Flags [+1]: 
+	    no Attribute 19 decoder
+	    0x0000:  01
+	      PMSI Tunnel (22), length: 1, Flags [+1]: [|BGP]
diff --git a/tests/bgp_pmsi_tunnel-oobr.pcap b/tests/bgp_pmsi_tunnel-oobr.pcap
new file mode 100644
index 0000000000..33cf660ce0
Binary files /dev/null and b/tests/bgp_pmsi_tunnel-oobr.pcap differ

Vulnerable code:                 ND_TCHECK2(tptr[0], 5);
Fixed code:                 ND_TCHECK2(tptr[0], 5);
bgp_pmsi_tunnel-oobr	bgp_pmsi_tunnel-oobr.pcap	bgp_pmsi_tunnel-oobr.out -v -c1
IP (tos 0x0, ttl 254, id 40207, offset 0, flags [+, DF, rsvd], proto TCP (6), length 296, bad cksum 8e15 (->3eaa)!)
    241.0.32.19.179 > 239.0.0.1.0: Flags [none], seq 2146695561:2146695813, win 56026, options [unknown-161,eol], length 252: BGP
	Update Message (2), length: 45
	  Withdrawn routes: 3 bytes
	  Attribute Set (128), length: 7, Flags [OTPE+f]: 
	    Origin AS: 4067
	      Origin (1), length: 1EGP
	      Unknown Attribute (19), length: 1, Flags [+1]: 
	    no Attribute 19 decoder
	    0x0000:  01
	      PMSI Tunnel (22), length: 1, Flags [+1]: [|BGP]