CVE-2017-13687 (published 2017-09-14T06:29Z)

The Cisco HDLC parser in tcpdump before 4.9.2 has a buffer over-read in print-chdlc.c:chdlc_print().

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Denis Ovsienko
author_date: 2017-02-03 13:14:51+00:00
msg: CVE-2017-13687/CHDLC: Improve bounds and length checks.

Prevent a possible buffer overread in chdlc_print() and replace the
custom check in chdlc_if_print() with a standard check in chdlc_print()
so that the latter certainly does not over-read even when reached via
juniper_chdlc_print(). Add length checks.
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: print-chdlc.c
change_type: ModificationType.MODIFY
diff: @@ -46,21 +46,18 @@ static const struct tok chdlc_cast_values[] = {
 u_int
 chdlc_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, register const u_char *p)
 {
-	register u_int length = h->len;
-	register u_int caplen = h->caplen;
-
-	if (caplen < CHDLC_HDRLEN) {
-		ND_PRINT((ndo, "[|chdlc]"));
-		return (caplen);
-	}
-        return (chdlc_print(ndo, p,length));
+	return chdlc_print(ndo, p, h->len);
 }
 
 u_int
 chdlc_print(netdissect_options *ndo, register const u_char *p, u_int length)
 {
 	u_int proto;
+	const u_char *bp = p;
 
+	if (length < CHDLC_HDRLEN)
+		goto trunc;
+	ND_TCHECK2(*p, CHDLC_HDRLEN);
 	proto = EXTRACT_16BITS(&p[2]);
 	if (ndo->ndo_eflag) {
                 ND_PRINT((ndo, "%s, ethertype %s (0x%04x), length %u: ",
@@ -94,6 +91,9 @@ chdlc_print(netdissect_options *ndo, register const u_char *p, u_int length)
 		break;
         case ETHERTYPE_ISO:
                 /* is the fudge byte set ? lets verify by spotting ISO headers */
+                if (length < 2)
+                    goto trunc;
+                ND_TCHECK_16BITS(p);
                 if (*(p+1) == 0x81 ||
                     *(p+1) == 0x82 ||
                     *(p+1) == 0x83)
@@ -108,6 +108,10 @@ chdlc_print(netdissect_options *ndo, register const u_char *p, u_int length)
 	}
 
 	return (CHDLC_HDRLEN);
+
+trunc:
+	ND_PRINT((ndo, "[|chdlc]"));
+	return ndo->ndo_snapend - bp;
 }
 
 /*

programming_language: C
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Guy Harris
author_date: 2017-02-08 10:54:27-08:00
msg: CVE-2017-13687/CHDLC: Add a test.

This is for the fix made a few commits before, which had no tests.

Add a test using the capture file supplied by Kamil Frankowicz.
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: TESTLIST
change_type: ModificationType.MODIFY
diff: @@ -455,6 +455,7 @@ hoobr_juniper		hoobr_juniper.pcap		hoobr_juniper.out
 hoobr_juniper2		hoobr_juniper2.pcap		hoobr_juniper2.out
 hoobr_juniper3		hoobr_juniper3.pcap		hoobr_juniper3.out
 hoobr_parse_field	hoobr_parse_field.pcap		hoobr_parse_field.out
+hoobr_chdlc_print	hoobr_chdlc_print.pcap		hoobr_chdlc_print.out
 
 # bad packets from Wilfried Kirsch
 slip-bad-direction	slip-bad-direction.pcap		slip-bad-direction.out	-ve

programming_language: Shell
filename: hoobr_chdlc_print.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1,26 @@
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+[|chdlc]

programming_language: Lua