CVE-2017-13017: Out-of-bounds Read (CWE-125)
value: The DHCPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-dhcp6.c:dhcp6opt_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-dhcp6.c, tests/TESTLIST, tests/dhcp6_reconf_asan.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13017/DHCPv6: Add a missing option length check.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.

Diff: diff --git a/print-dhcp6.c b/print-dhcp6.c
index 762d9187eb..cbb6d84a05 100644
--- a/print-dhcp6.c
+++ b/print-dhcp6.c
@@ -516,10 +516,14 @@ dhcp6opt_print(netdissect_options *ndo,
 			for (i = 0; i < optlen && i < 10; i++)
 				ND_PRINT((ndo, "%02x", tp[i]));
 			ND_PRINT((ndo, "...)"));
 			break;
 		case DH6OPT_RECONF_MSG:
+			if (optlen != 1) {
+				ND_PRINT((ndo, " ?)"));
+				break;
+			}
 			tp = (const u_char *)(dh6o + 1);
 			switch (*tp) {
 			case DH6_RENEW:
 				ND_PRINT((ndo, " for renew)"));
 				break;
diff --git a/tests/TESTLIST b/tests/TESTLIST
index a56c3c9500..3f5726601b 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -516,10 +516,11 @@ eap_extract_read2_asan	eap_extract_read2_asan.pcap	eap_extract_read2_asan.out	-v
 esis_snpa_asan		esis_snpa_asan.pcap		esis_snpa_asan.out	-v
 esis_snpa_asan-2	esis_snpa_asan-2.pcap		esis_snpa_asan-2.out	-v
 esis_snpa_asan-3	esis_snpa_asan-3.pcap		esis_snpa_asan-3.out	-v
 esis_snpa_asan-4	esis_snpa_asan-4.pcap		esis_snpa_asan-4.out	-v
 esis_snpa_asan-5	esis_snpa_asan-5.pcap		esis_snpa_asan-5.out	-v
+dhcp6_reconf_asan	dhcp6_reconf_asan.pcap		dhcp6_reconf_asan.out	-v
 
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp
 rtp-seg-fault-2  rtp-seg-fault-2.pcap  rtp-seg-fault-2.out  -v -T rtp
diff --git a/tests/dhcp6_reconf_asan.out b/tests/dhcp6_reconf_asan.out
new file mode 100644
index 0000000000..3f3937346c
--- /dev/null
+++ b/tests/dhcp6_reconf_asan.out
@@ -0,0 +1,2 @@
+IP (tos 0x60, ttl 254, id 21519, offset 0, flags [+, DF, rsvd], proto UDP (17), length 768, options (EOL), bad cksum 9615 (->c6f)!)
+    251.73.86.150.514 > 126.172.217.192.546: dhcp6 relay-reply (linkaddr=300:10ed:ff:f01:f:0:7f:7f peeraddr=ffb6:3a64::c1:2300:581c:d00 (reconfigure-message ?) (reconfigure-message ?))
diff --git a/tests/dhcp6_reconf_asan.pcap b/tests/dhcp6_reconf_asan.pcap
new file mode 100644
index 0000000000..3eb6fe02ad
Binary files /dev/null and b/tests/dhcp6_reconf_asan.pcap differ

Fixed code: 			if (optlen != 1) {
				ND_PRINT((ndo, " ?)"));
				break;
			}
dhcp6_reconf_asan	dhcp6_reconf_asan.pcap		dhcp6_reconf_asan.out	-v
IP (tos 0x60, ttl 254, id 21519, offset 0, flags [+, DF, rsvd], proto UDP (17), length 768, options (EOL), bad cksum 9615 (->c6f)!)
    251.73.86.150.514 > 126.172.217.192.546: dhcp6 relay-reply (linkaddr=300:10ed:ff:f01:f:0:7f:7f peeraddr=ffb6:3a64::c1:2300:581c:d00 (reconfigure-message ?) (reconfigure-message ?))