diff mbox series

[meta-networking,dunfell] dnsmasq: Fix CVE-2022-0934

Message ID 20220921100445.12649-1-virendra.thakur@kpit.com
State Under Review
Delegated to: Armin Kuster
Headers show
Series [meta-networking,dunfell] dnsmasq: Fix CVE-2022-0934 | expand

Commit Message

Virendra Kumar Thakur Sept. 21, 2022, 10:04 a.m. UTC 
From: Virendra Thakur <virendrak@kpit.com>

Add patch to fix CVE-2022-0934

Link: https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=patch;h=03345ecefeb0d82e3c3a4c28f27c3554f0611b39

Signed-off-by: Virendra Thakur <virendrak@kpit.com>
---
 .../recipes-support/dnsmasq/dnsmasq_2.81.bb   |   1 +
 .../dnsmasq/files/CVE-2022-0934.patch         | 188 ++++++++++++++++++
 2 files changed, 189 insertions(+)
 create mode 100644 meta-networking/recipes-support/dnsmasq/files/CVE-2022-0934.patch

--
2.17.1

This message contains information that may be privileged or confidential and is the property of the KPIT Technologies Ltd. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message. KPIT Technologies Ltd. does not accept any liability for virus infected mails.

Comments

Virendra Kumar Thakur Sept. 29, 2022, 1:52 p.m. UTC | #1 
Hi Armin,

Looks like there is some issue with the mailer . as it was observed earlier also when i submitted my patch to poky .

I am attaching here with the patch file with this can you please check.
 Hope issue will not come.  As with the same change i am able to build in my setup.

Sorry for inconvenience.

Best Regards
Virendra Thakur
diff mbox series

Patch

diff --git a/meta-networking/recipes-support/dnsmasq/dnsmasq_2.81.bb b/meta-networking/recipes-support/dnsmasq/dnsmasq_2.81.bb
index 2fb389915..8db57edb7 100644
--- a/meta-networking/recipes-support/dnsmasq/dnsmasq_2.81.bb
+++ b/meta-networking/recipes-support/dnsmasq/dnsmasq_2.81.bb
@@ -11,4 +11,5 @@  SRC_URI += "\
     file://CVE-2020-25686-1.patch \
     file://CVE-2020-25686-2.patch \
     file://CVE-2021-3448.patch \
+    file://CVE-2022-0934.patch \
 "
diff --git a/meta-networking/recipes-support/dnsmasq/files/CVE-2022-0934.patch b/meta-networking/recipes-support/dnsmasq/files/CVE-2022-0934.patch
new file mode 100644
index 000000000..f14fc358b
--- /dev/null
+++ b/meta-networking/recipes-support/dnsmasq/files/CVE-2022-0934.patch
@@ -0,0 +1,188 @@ 
+From 03345ecefeb0d82e3c3a4c28f27c3554f0611b39 Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Thu, 31 Mar 2022 21:35:20 +0100
+Subject: [PATCH] Fix write-after-free error in DHCPv6 code. CVE-2022-0934
+ refers.
+
+Upstream-Status: Backport [https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=patch;h=03345ecefeb0d82e3c3a4c28f27c3554f0611b39]
+CVE: CVE-2022-0934
+Comment: Hunk from CHANGELOG and rfc3315.c are refresh base on dnsmasq 2.81 version
+Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
+---
+Index: dnsmasq-2.81/CHANGELOG
+===================================================================
+--- dnsmasq-2.81.orig/CHANGELOG
++++ dnsmasq-2.81/CHANGELOG
+@@ -88,6 +88,9 @@ version 2.81
+
+       Add --script-on-renewal option.
+
++      Fix write-after-free error in DHCPv6 server code.
++      CVE-2022-0934 refers.
++
+
+ version 2.80
+       Add support for RFC 4039 DHCP rapid commit. Thanks to Ashram Method
+Index: dnsmasq-2.81/src/rfc3315.c
+===================================================================
+--- dnsmasq-2.81.orig/src/rfc3315.c
++++ dnsmasq-2.81/src/rfc3315.c
+@@ -33,9 +33,9 @@ struct state {
+   unsigned int mac_len, mac_type;
+ };
+
+-static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,
++static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz,
+                            struct in6_addr *client_addr, int is_unicast, time_t now);
+-static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now);
++static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now);
+ static void log6_opts(int nest, unsigned int xid, void *start_opts, void *end_opts);
+ static void log6_packet(struct state *state, char *type, struct in6_addr *addr, char *string);
+ static void log6_quiet(struct state *state, char *type, struct in6_addr *addr, char *string);
+@@ -104,12 +104,12 @@ unsigned short dhcp6_reply(struct dhcp_c
+ }
+
+ /* This cost me blood to write, it will probably cost you blood to understand - srk. */
+-static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,
++static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz,
+                            struct in6_addr *client_addr, int is_unicast, time_t now)
+ {
+   void *end = inbuff + sz;
+   void *opts = inbuff + 34;
+-  int msg_type = *((unsigned char *)inbuff);
++  int msg_type = *inbuff;
+   unsigned char *outmsgtypep;
+   void *opt;
+   struct dhcp_vendor *vendor;
+@@ -259,15 +259,15 @@ static int dhcp6_maybe_relay(struct stat
+   return 1;
+ }
+
+-static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now)
++static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now)
+ {
+   void *opt;
+-  int i, o, o1, start_opts;
++  int i, o, o1, start_opts, start_msg;
+   struct dhcp_opt *opt_cfg;
+   struct dhcp_netid *tagif;
+   struct dhcp_config *config = NULL;
+   struct dhcp_netid known_id, iface_id, v6_id;
+-  unsigned char *outmsgtypep;
++  unsigned char outmsgtype;
+   struct dhcp_vendor *vendor;
+   struct dhcp_context *context_tmp;
+   struct dhcp_mac *mac_opt;
+@@ -296,12 +296,13 @@ static int dhcp6_no_relay(struct state *
+   v6_id.next = state->tags;
+   state->tags = &v6_id;
+
+-  /* copy over transaction-id, and save pointer to message type */
+-  if (!(outmsgtypep = put_opt6(inbuff, 4)))
++  start_msg = save_counter(-1);
++  /* copy over transaction-id */
++  if (!put_opt6(inbuff, 4))
+     return 0;
+   start_opts = save_counter(-1);
+-  state->xid = outmsgtypep[3] | outmsgtypep[2] << 8 | outmsgtypep[1] << 16;
+-
++  state->xid = inbuff[3] | inbuff[2] << 8 | inbuff[1] << 16;
++
+   /* We're going to be linking tags from all context we use.
+      mark them as unused so we don't link one twice and break the list */
+   for (context_tmp = state->context; context_tmp; context_tmp = context_tmp->current)
+@@ -347,7 +348,7 @@ static int dhcp6_no_relay(struct state *
+       (msg_type == DHCP6REQUEST || msg_type == DHCP6RENEW || msg_type == DHCP6RELEASE || msg_type == DHCP6DECLINE))
+
+     {
+-      *outmsgtypep = DHCP6REPLY;
++      outmsgtype = DHCP6REPLY;
+       o1 = new_opt6(OPTION6_STATUS_CODE);
+       put_opt6_short(DHCP6USEMULTI);
+       put_opt6_string("Use multicast");
+@@ -619,11 +620,11 @@ static int dhcp6_no_relay(struct state *
+       struct dhcp_netid *solicit_tags;
+       struct dhcp_context *c;
+
+-      *outmsgtypep = DHCP6ADVERTISE;
++      outmsgtype = DHCP6ADVERTISE;
+
+       if (opt6_find(state->packet_options, state->end, OPTION6_RAPID_COMMIT, 0))
+         {
+-          *outmsgtypep = DHCP6REPLY;
++          outmsgtype = DHCP6REPLY;
+           state->lease_allocate = 1;
+           o = new_opt6(OPTION6_RAPID_COMMIT);
+           end_opt6(o);
+@@ -809,7 +810,7 @@ static int dhcp6_no_relay(struct state *
+       int start = save_counter(-1);
+
+       /* set reply message type */
+-      *outmsgtypep = DHCP6REPLY;
++      outmsgtype = DHCP6REPLY;
+       state->lease_allocate = 1;
+
+       log6_quiet(state, "DHCPREQUEST", NULL, ignore ? _("ignored") : NULL);
+@@ -921,7 +922,7 @@ static int dhcp6_no_relay(struct state *
+     case DHCP6RENEW:
+       {
+       /* set reply message type */
+-      *outmsgtypep = DHCP6REPLY;
++      outmsgtype = DHCP6REPLY;
+
+       log6_quiet(state, "DHCPRENEW", NULL, NULL);
+
+@@ -1033,7 +1034,7 @@ static int dhcp6_no_relay(struct state *
+       int good_addr = 0;
+
+       /* set reply message type */
+-      *outmsgtypep = DHCP6REPLY;
++      outmsgtype = DHCP6REPLY;
+
+       log6_quiet(state, "DHCPCONFIRM", NULL, NULL);
+
+@@ -1097,7 +1098,7 @@ static int dhcp6_no_relay(struct state *
+       log6_quiet(state, "DHCPINFORMATION-REQUEST", NULL, ignore ? _("ignored") : state->hostname);
+       if (ignore)
+         return 0;
+-      *outmsgtypep = DHCP6REPLY;
++      outmsgtype = DHCP6REPLY;
+       tagif = add_options(state, 1);
+       break;
+       }
+@@ -1106,7 +1107,7 @@ static int dhcp6_no_relay(struct state *
+     case DHCP6RELEASE:
+       {
+       /* set reply message type */
+-      *outmsgtypep = DHCP6REPLY;
++      outmsgtype = DHCP6REPLY;
+
+       log6_quiet(state, "DHCPRELEASE", NULL, NULL);
+
+@@ -1171,7 +1172,7 @@ static int dhcp6_no_relay(struct state *
+     case DHCP6DECLINE:
+       {
+       /* set reply message type */
+-      *outmsgtypep = DHCP6REPLY;
++      outmsgtype = DHCP6REPLY;
+
+       log6_quiet(state, "DHCPDECLINE", NULL, NULL);
+
+@@ -1251,10 +1252,15 @@ static int dhcp6_no_relay(struct state *
+       }
+
+     }
+-
++
++  /* Fill in the message type. Note that we store the offset,
++     not a direct pointer, since the packet memory may have been
++     reallocated. */
++  ((unsigned char *)(daemon->outpacket.iov_base))[start_msg] = outmsgtype;
++
+   log_tags(tagif, state->xid);
+   log6_opts(0, state->xid, daemon->outpacket.iov_base + start_opts, daemon->outpacket.iov_base + save_counter(-1));
+-
++
+   return 1;
+
+ }