CVE-2017-13005 (Other, published 2017-09-14T06:29Z)
Description: value: The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:xid_map_enter().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-nfs.c
tests/TESTLIST
tests/hoobr_nfs_xid_map_enter.out
Commit message: CVE-2017-13005/NFS: Add two bounds checks before fetching data

This fixes a buffer over-read discovered by Kamil Frankowicz.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:

Fixed code:
	if (!ND_TTEST(rp->rm_call.cb_proc))
		return (0);
	if (!ND_TTEST(rp->rm_call.cb_vers))
		return (0);
hoobr_nfs_xid_map_enter hoobr_nfs_xid_map_enter.pcap    hoobr_nfs_xid_map_enter.out
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0020:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0030:  30                                       0
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0020:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0030:  30                                       0
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0020:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0030:  30                                       0
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0020:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0030:  30                                       0
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0020:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0030:  30                                       0
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0020:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0030:  30                                       0
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0020:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0030:  30                                       0
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0020:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0030:  30                                       0
IP 48.48.48.48.12336 > 48.48.48.48.2049: NFS request xid 808464432 12308 [|nfs]