CVE-2017-13031: Out-of-bounds Read (CWE-125)
value: The IPv6 fragmentation header parser in tcpdump before 4.9.2 has a buffer over-read in print-frag6.c:frag6_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-frag6.c, tests/TESTLIST, tests/ip6_frag_asan.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13031/Check for the presence of the entire IPv6 fragment header.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.

Clean up some whitespace in tests/TESTLIST while we're at it.

Diff: diff --git a/print-frag6.c b/print-frag6.c
index 03836adbb2..fbcabc5b00 100644
--- a/print-frag6.c
+++ b/print-frag6.c
@@ -39,11 +39,11 @@ frag6_print(netdissect_options *ndo, register const u_char *bp, register const u
 	register const struct ip6_hdr *ip6;
 
 	dp = (const struct ip6_frag *)bp;
 	ip6 = (const struct ip6_hdr *)bp2;
 
-	ND_TCHECK(dp->ip6f_offlg);
+	ND_TCHECK(*dp);
 
 	if (ndo->ndo_vflag) {
 		ND_PRINT((ndo, "frag (0x%08x:%d|%ld)",
 		       EXTRACT_32BITS(&dp->ip6f_ident),
 		       EXTRACT_16BITS(&dp->ip6f_offlg) & IP6F_OFF_MASK,
diff --git a/tests/TESTLIST b/tests/TESTLIST
index bc1af3663f..8e88e93ea7 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -534,13 +534,14 @@ isis_stlv_asan-2	isis_stlv_asan-2.pcap		isis_stlv_asan-2.out	-v
 isis_stlv_asan-3	isis_stlv_asan-3.pcap		isis_stlv_asan-3.out	-v
 isis_stlv_asan-4	isis_stlv_asan-4.pcap		isis_stlv_asan-4.out	-v
 lldp_mgmt_addr_tlv_asan	lldp_mgmt_addr_tlv_asan.pcap	lldp_mgmt_addr_tlv_asan.out	-v
 bootp_asan		bootp_asan.pcap			bootp_asan.out		-v
 ppp_ccp_config_deflate_option_asan	ppp_ccp_config_deflate_option_asan.pcap	ppp_ccp_config_deflate_option_asan.out	-v
-pim_header_asan		pim_header_asan.pcap		pim_header_asan.out		-v
-pim_header_asan-2	pim_header_asan-2.pcap		pim_header_asan-2.out		-v
-pim_header_asan-3	pim_header_asan-3.pcap		pim_header_asan-3.out		-v
+pim_header_asan		pim_header_asan.pcap		pim_header_asan.out	-v
+pim_header_asan-2	pim_header_asan-2.pcap		pim_header_asan-2.out	-v
+pim_header_asan-3	pim_header_asan-3.pcap		pim_header_asan-3.out	-v
+ip6_frag_asan		ip6_frag_asan.pcap		ip6_frag_asan.out	-v
 
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp
 rtp-seg-fault-2  rtp-seg-fault-2.pcap  rtp-seg-fault-2.out  -v -T rtp
diff --git a/tests/ip6_frag_asan.out b/tests/ip6_frag_asan.out
new file mode 100644
index 0000000000..2daba4254a
--- /dev/null
+++ b/tests/ip6_frag_asan.out
@@ -0,0 +1 @@
+IP6 (class 0x51, flowlabel 0xb2100, hlim 16, next-header Fragment (44) payload length: 27136) 452:22:19:0:41a:e4ff:10ff:484d > 2243:80:1400:100:19:ffff:ffff:fffb: [|frag]
diff --git a/tests/ip6_frag_asan.pcap b/tests/ip6_frag_asan.pcap
new file mode 100644
index 0000000000..a99a22d126
Binary files /dev/null and b/tests/ip6_frag_asan.pcap differ

Vulnerable code: 	ND_TCHECK(dp->ip6f_offlg);
pim_header_asan		pim_header_asan.pcap		pim_header_asan.out		-v
pim_header_asan-2	pim_header_asan-2.pcap		pim_header_asan-2.out		-v
pim_header_asan-3	pim_header_asan-3.pcap		pim_header_asan-3.out		-v
Fixed code: 	ND_TCHECK(*dp);
pim_header_asan		pim_header_asan.pcap		pim_header_asan.out	-v
pim_header_asan-2	pim_header_asan-2.pcap		pim_header_asan-2.out	-v
pim_header_asan-3	pim_header_asan-3.pcap		pim_header_asan-3.out	-v
ip6_frag_asan		ip6_frag_asan.pcap		ip6_frag_asan.out	-v
IP6 (class 0x51, flowlabel 0xb2100, hlim 16, next-header Fragment (44) payload length: 27136) 452:22:19:0:41a:e4ff:10ff:484d > 2243:80:1400:100:19:ffff:ffff:fffb: [|frag]