dnsproxy: Address CVE-2025-32366 vulnerability
diff mbox series

Message ID 20250512084818.411262-1-michael@amarulasolutions.com
State New
Headers show
Series
  • dnsproxy: Address CVE-2025-32366 vulnerability
Related show

Commit Message

Michael Nazzareno Trimarchi May 12, 2025, 8:48 a.m. UTC 
From: 신윤제(학부생-소프트웨어전공) <ioerts@kookmin.ac.kr>

In Connman parse_rr in dnsproxy.c has a memcpy length
that depends on an RR RDLENGTH value (i.e., *rdlen=ntohs(rr->rdlen)
and memcpy(response+offset,*end,*rdlen)). Here, rdlen may be larger
than the amount of remaining packet data in the current state of
parsing. As a result, values of stack memory locations may be sent
over the network in a response.

This patch adds a check to ensure that (*end + *rdlen) does not exceed
the valid range. If the condition is violated, the function returns
-EINVAL.
---
V1->V2:
	- resent using proper inline patch
---
 src/dnsproxy.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

'Julien Olivain' via Amarula Linux May 12, 2025, 7:10 p.m. UTC | #1 
Hello:

This patch was applied to connman.git (master)
by Denis Kenzior <denkenz@gmail.com>:

On Mon, 12 May 2025 10:48:18 +0200 you wrote:
> From: 신윤제(학부생-소프트웨어전공) <ioerts@kookmin.ac.kr>
> 
> In Connman parse_rr in dnsproxy.c has a memcpy length
> that depends on an RR RDLENGTH value (i.e., *rdlen=ntohs(rr->rdlen)
> and memcpy(response+offset,*end,*rdlen)). Here, rdlen may be larger
> than the amount of remaining packet data in the current state of
> parsing. As a result, values of stack memory locations may be sent
> over the network in a response.
> 
> [...]

Here is the summary with links:
  - dnsproxy: Address CVE-2025-32366 vulnerability
    https://git.kernel.org/pub/scm/network/connman/connman.git/?id=8d3be0285f1d

You are awesome, thank you!

Patch
diff mbox series 

diff --git a/src/dnsproxy.c b/src/dnsproxy.c
index 7ee26d9f..1dd2f7f5 100644
--- a/src/dnsproxy.c
+++ b/src/dnsproxy.c
@@ -998,6 +998,9 @@  static int parse_rr(const unsigned char *buf, const unsigned char *start,
 	if ((offset + *rdlen) > *response_size)
 		return -ENOBUFS;
 
+	if ((*end + *rdlen) > max)
+		return -EINVAL;
+
 	memcpy(response + offset, *end, *rdlen);
 
 	*end += *rdlen;