mirror of
https://github.com/openwrt/openwrt.git
synced 2025-02-10 04:41:49 +00:00
8055e38794
This fixes the following security problems in dnsmasq: * CVE-2020-25681: Dnsmasq versions before 2.83 is susceptible to a heap-based buffer overflow in sort_rrset() when DNSSEC is used. This can allow a remote attacker to write arbitrary data into target device's memory that can lead to memory corruption and other unexpected behaviors on the target device. * CVE-2020-25682: Dnsmasq versions before 2.83 is susceptible to buffer overflow in extract_name() function due to missing length check, when DNSSEC is enabled. This can allow a remote attacker to cause memory corruption on the target device. * CVE-2020-25683: Dnsmasq version before 2.83 is susceptible to a heap-based buffer overflow when DNSSEC is enabled. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap- allocated memory. This flaw is caused by the lack of length checks in rtc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in Dnsmasq, resulting in a Denial of Service. * CVE-2020-25684: A lack of proper address/port check implemented in Dnsmasq version < 2.83 reply_query function makes forging replies easier to an off-path attacker. * CVE-2020-25685: A lack of query resource name (RRNAME) checks implemented in Dnsmasq's versions before 2.83 reply_query function allows remote attackers to spoof DNS traffic that can lead to DNS cache poisoning. * CVE-2020-25686: Multiple DNS query requests for the same resource name (RRNAME) by Dnsmasq versions before 2.83 allows for remote attackers to spoof DNS traffic, using a birthday attack (RFC 5452), that can lead to DNS cache poisoning. * CVE-2020-25687: Dnsmasq versions before 2.83 is vulnerable to a heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rtc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a Denial of Service. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
57 lines
1.8 KiB
Diff
57 lines
1.8 KiB
Diff
From 6a6e06fbb0d4690507ceaf2bb6f0d8910f3d4914 Mon Sep 17 00:00:00 2001
|
|
From: Simon Kelley <simon@thekelleys.org.uk>
|
|
Date: Fri, 4 Dec 2020 18:35:11 +0000
|
|
Subject: Small cleanups in frec_src datastucture handling.
|
|
|
|
---
|
|
src/forward.c | 22 +++++++++++++---------
|
|
1 file changed, 13 insertions(+), 9 deletions(-)
|
|
|
|
--- a/src/forward.c
|
|
+++ b/src/forward.c
|
|
@@ -353,7 +353,10 @@ static int forward_query(int udpfd, unio
|
|
if (!daemon->free_frec_src &&
|
|
daemon->frec_src_count < daemon->ftabsize &&
|
|
(daemon->free_frec_src = whine_malloc(sizeof(struct frec_src))))
|
|
- daemon->frec_src_count++;
|
|
+ {
|
|
+ daemon->frec_src_count++;
|
|
+ daemon->free_frec_src->next = NULL;
|
|
+ }
|
|
|
|
/* If we've been spammed with many duplicates, just drop the query. */
|
|
if (daemon->free_frec_src)
|
|
@@ -390,6 +393,7 @@ static int forward_query(int udpfd, unio
|
|
forward->frec_src.orig_id = ntohs(header->id);
|
|
forward->frec_src.dest = *dst_addr;
|
|
forward->frec_src.iface = dst_iface;
|
|
+ forward->frec_src.next = NULL;
|
|
forward->new_id = get_id();
|
|
forward->fd = udpfd;
|
|
memcpy(forward->hash, hash, HASH_SIZE);
|
|
@@ -2226,16 +2230,16 @@ void free_rfd(struct randfd *rfd)
|
|
|
|
static void free_frec(struct frec *f)
|
|
{
|
|
- struct frec_src *src, *tmp;
|
|
-
|
|
- /* add back to freelist of not the record builtin to every frec. */
|
|
- for (src = f->frec_src.next; src; src = tmp)
|
|
+ struct frec_src *last;
|
|
+
|
|
+ /* add back to freelist if not the record builtin to every frec. */
|
|
+ for (last = f->frec_src.next; last && last->next; last = last->next) ;
|
|
+ if (last)
|
|
{
|
|
- tmp = src->next;
|
|
- src->next = daemon->free_frec_src;
|
|
- daemon->free_frec_src = src;
|
|
+ last->next = daemon->free_frec_src;
|
|
+ daemon->free_frec_src = f->frec_src.next;
|
|
}
|
|
-
|
|
+
|
|
f->frec_src.next = NULL;
|
|
free_rfd(f->rfd4);
|
|
f->rfd4 = NULL;
|