CVE-2017-13027: Out-of-bounds Read (CWE-125)
value: The LLDP parser in tcpdump before 4.9.2 has a buffer over-read in print-lldp.c:lldp_mgmt_addr_tlv_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-lldp.c, tests/TESTLIST, tests/lldp_mgmt_addr_tlv_asan.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13027/LLDP: Fix a bounds check.

The total length of the OID is the OID length plus the length of the OID
length itself.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.

Diff: diff --git a/print-lldp.c b/print-lldp.c
index dfdf1b94aa..3984a4f58b 100644
--- a/print-lldp.c
+++ b/print-lldp.c
@@ -1399,11 +1399,11 @@ lldp_mgmt_addr_tlv_print(netdissect_options *ndo,
      * The OID is optional.
      */
     if (tlen) {
         oid_len = *tptr;
 
-        if (tlen < oid_len) {
+        if (tlen < 1U + oid_len) {
             return 0;
         }
         if (oid_len) {
             ND_PRINT((ndo, "\n\t  OID length %u", oid_len));
             safeputs(ndo, tptr + 1, oid_len);
diff --git a/tests/TESTLIST b/tests/TESTLIST
index 9181bdf0d0..9ac274704c 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -530,10 +530,11 @@ mobility_opt_asan_3	mobility_opt_asan_3.pcap	mobility_opt_asan_3.out	-v
 mobility_opt_asan_4	mobility_opt_asan_4.pcap	mobility_opt_asan_4.out	-v
 isis_stlv_asan		isis_stlv_asan.pcap		isis_stlv_asan.out	-v
 isis_stlv_asan-2	isis_stlv_asan-2.pcap		isis_stlv_asan-2.out	-v
 isis_stlv_asan-3	isis_stlv_asan-3.pcap		isis_stlv_asan-3.out	-v
 isis_stlv_asan-4	isis_stlv_asan-4.pcap		isis_stlv_asan-4.out	-v
+lldp_mgmt_addr_tlv_asan	lldp_mgmt_addr_tlv_asan.pcap	lldp_mgmt_addr_tlv_asan.out	-v
 
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp
 rtp-seg-fault-2  rtp-seg-fault-2.pcap  rtp-seg-fault-2.out  -v -T rtp
diff --git a/tests/lldp_mgmt_addr_tlv_asan.out b/tests/lldp_mgmt_addr_tlv_asan.out
new file mode 100644
index 0000000000..10d759724f
--- /dev/null
+++ b/tests/lldp_mgmt_addr_tlv_asan.out
@@ -0,0 +1,8 @@
+LLDP, length 1048572
+	Management Address TLV (8), length 15
+	  Management Address length 6, AFI Reserved (0), no AF printer !
+	  Unknown Interface Numbering (10): 666137427
+	[|LLDP]
+00:00:00:a0:d4:c3 > 06:04:e8:03:00:02, ethertype Unknown (0xb2a1), length 58785857: 
+	0x0000:  0200 efff e5ff 804f 006e 0026 0000 0000  .......O.n.&....
+	0x0010:  01                                       .
diff --git a/tests/lldp_mgmt_addr_tlv_asan.pcap b/tests/lldp_mgmt_addr_tlv_asan.pcap
new file mode 100644
index 0000000000..a7aec5904a
Binary files /dev/null and b/tests/lldp_mgmt_addr_tlv_asan.pcap differ

Vulnerable code:         if (tlen < oid_len) {
Fixed code:         if (tlen < 1U + oid_len) {
lldp_mgmt_addr_tlv_asan	lldp_mgmt_addr_tlv_asan.pcap	lldp_mgmt_addr_tlv_asan.out	-v
LLDP, length 1048572
	Management Address TLV (8), length 15
	  Management Address length 6, AFI Reserved (0), no AF printer !
	  Unknown Interface Numbering (10): 666137427
	[|LLDP]
00:00:00:a0:d4:c3 > 06:04:e8:03:00:02, ethertype Unknown (0xb2a1), length 58785857: 
	0x0000:  0200 efff e5ff 804f 006e 0026 0000 0000  .......O.n.&....
	0x0010:  01                                       .