CVE-2017-13024 (published 2017-09-14T06:29Z)

The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print().

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Francois-Xavier Le Bail
author_date: 2017-03-22 16:27:48+01:00
msg: CVE-2017-13024/IPv6 mobility: Add a bounds check before fetching data

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't cause 'tcpdump: pcap_loop: truncated dump file'
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: print-mobility.c
change_type: ModificationType.MODIFY
diff: @@ -166,6 +166,8 @@ mobility_opt_print(netdissect_options *ndo,
 				ND_PRINT((ndo, "(ni: trunc)"));
 				goto trunc;
 			}
+			ND_TCHECK_16BITS(&bp[i+2]);
+			ND_TCHECK_16BITS(&bp[i+4]);
 			ND_PRINT((ndo, "(ni: ho=0x%04x co=0x%04x)",
 				EXTRACT_16BITS(&bp[i+2]),
 				EXTRACT_16BITS(&bp[i+4])));

programming_language: C
filename: TESTLIST
change_type: ModificationType.MODIFY
diff: @@ -525,6 +525,7 @@ vtp_asan		vtp_asan.pcap			vtp_asan.out	-v
 icmp6_mobileprefix_asan	icmp6_mobileprefix_asan.pcap	icmp6_mobileprefix_asan.out	-v
 ip_printroute_asan	ip_printroute_asan.pcap		ip_printroute_asan.out	-v
 mobility_opt_asan	mobility_opt_asan.pcap		mobility_opt_asan.out	-v
+mobility_opt_asan_2	mobility_opt_asan_2.pcap	mobility_opt_asan_2.out	-v
 
 # RTP tests
 # fuzzed pcap

programming_language: Shell
filename: mobility_opt_asan_2.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1 @@
+IP6 (class 0x50, flowlabel 0x0002c, hlim 0, next-header Mobile IP (old) (62) payload length: 7168) ff:7f0f:40:0:ee00:0:b658:5203 > 205:20:1:b00:0:2200:af01:e000: mobility: BRR(type-0x06: len=0)[|MOBILITY]

programming_language: Batchfile
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Francois-Xavier Le Bail
author_date: 2017-03-22 18:03:24+01:00
msg: CVE-2017-13024/IPv6 mobility: Add another test for a previous bounds check fix

This is another capture file supplied by Bhargava Shastry, modified
so the capture file won't cause 'tcpdump: pcap_loop: truncated dump file'
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: TESTLIST
change_type: ModificationType.MODIFY
diff: @@ -527,6 +527,7 @@ ip_printroute_asan	ip_printroute_asan.pcap		ip_printroute_asan.out	-v
 mobility_opt_asan	mobility_opt_asan.pcap		mobility_opt_asan.out	-v
 mobility_opt_asan_2	mobility_opt_asan_2.pcap	mobility_opt_asan_2.out	-v
 mobility_opt_asan_3	mobility_opt_asan_3.pcap	mobility_opt_asan_3.out	-v
+mobility_opt_asan_4	mobility_opt_asan_4.pcap	mobility_opt_asan_4.out	-v
 
 # RTP tests
 # fuzzed pcap

programming_language: Shell
filename: mobility_opt_asan_4.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1 @@
+IP6 (class 0x50, flowlabel 0x00004, hlim 237, next-header Mobile IP (old) (62) payload length: 7168) d3c3:b2a9:200:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: BU seq#=116 A lifetime=15360(pad1)(pad1)(type-0x3c: len=19)(ni: ho=0x0400 co=0x0012)[|MOBILITY]

programming_language: Batchfile