0012-lanp-Fix-buffer-overflows-in-get_lan_param_select.patch 3.3 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192
  1. From ceebf5998b71e11c81133680560b498977d3d3cd Mon Sep 17 00:00:00 2001
  2. From: Chrostoper Ertl <chertl@microsoft.com>
  3. Date: Thu, 28 Nov 2019 17:06:39 +0000
  4. Subject: [PATCH] lanp: Fix buffer overflows in get_lan_param_select
  5. MIME-Version: 1.0
  6. Content-Type: text/plain; charset=UTF-8
  7. Content-Transfer-Encoding: 8bit
  8. Partial fix for CVE-2020-5208, see
  9. https://github.com/ipmitool/ipmitool/security/advisories/GHSA-g659-9qxw-p7cp
  10. The `get_lan_param_select` function is missing a validation check on the
  11. response’s `data_len`, which it then returns to caller functions, where
  12. stack buffer overflow can occur.
  13. [Retrieve from:
  14. https://github.com/ipmitool/ipmitool/commit/d45572d71e70840e0d4c50bf48218492b79c1a10]
  15. Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
  16. ---
  17. lib/ipmi_lanp.c | 14 +++++++-------
  18. 1 file changed, 7 insertions(+), 7 deletions(-)
  19. diff --git a/lib/ipmi_lanp.c b/lib/ipmi_lanp.c
  20. index 65d881b..022c7f1 100644
  21. --- a/lib/ipmi_lanp.c
  22. +++ b/lib/ipmi_lanp.c
  23. @@ -1809,7 +1809,7 @@ ipmi_lan_alert_set(struct ipmi_intf * intf, uint8_t chan, uint8_t alert,
  24. if (p == NULL) {
  25. return (-1);
  26. }
  27. - memcpy(data, p->data, p->data_len);
  28. + memcpy(data, p->data, __min(p->data_len, sizeof(data)));
  29. /* set new ipaddr */
  30. memcpy(data+3, temp, 4);
  31. printf("Setting LAN Alert %d IP Address to %d.%d.%d.%d\n", alert,
  32. @@ -1824,7 +1824,7 @@ ipmi_lan_alert_set(struct ipmi_intf * intf, uint8_t chan, uint8_t alert,
  33. if (p == NULL) {
  34. return (-1);
  35. }
  36. - memcpy(data, p->data, p->data_len);
  37. + memcpy(data, p->data, __min(p->data_len, sizeof(data)));
  38. /* set new macaddr */
  39. memcpy(data+7, temp, 6);
  40. printf("Setting LAN Alert %d MAC Address to "
  41. @@ -1838,7 +1838,7 @@ ipmi_lan_alert_set(struct ipmi_intf * intf, uint8_t chan, uint8_t alert,
  42. if (p == NULL) {
  43. return (-1);
  44. }
  45. - memcpy(data, p->data, p->data_len);
  46. + memcpy(data, p->data, __min(p->data_len, sizeof(data)));
  47. if (strncasecmp(argv[1], "def", 3) == 0 ||
  48. strncasecmp(argv[1], "default", 7) == 0) {
  49. @@ -1864,7 +1864,7 @@ ipmi_lan_alert_set(struct ipmi_intf * intf, uint8_t chan, uint8_t alert,
  50. if (p == NULL) {
  51. return (-1);
  52. }
  53. - memcpy(data, p->data, p->data_len);
  54. + memcpy(data, p->data, __min(p->data_len, sizeof(data)));
  55. if (strncasecmp(argv[1], "on", 2) == 0 ||
  56. strncasecmp(argv[1], "yes", 3) == 0) {
  57. @@ -1889,7 +1889,7 @@ ipmi_lan_alert_set(struct ipmi_intf * intf, uint8_t chan, uint8_t alert,
  58. if (p == NULL) {
  59. return (-1);
  60. }
  61. - memcpy(data, p->data, p->data_len);
  62. + memcpy(data, p->data, __min(p->data_len, sizeof(data)));
  63. if (strncasecmp(argv[1], "pet", 3) == 0) {
  64. printf("Setting LAN Alert %d destination to PET Trap\n", alert);
  65. @@ -1917,7 +1917,7 @@ ipmi_lan_alert_set(struct ipmi_intf * intf, uint8_t chan, uint8_t alert,
  66. if (p == NULL) {
  67. return (-1);
  68. }
  69. - memcpy(data, p->data, p->data_len);
  70. + memcpy(data, p->data, __min(p->data_len, sizeof(data)));
  71. if (str2uchar(argv[1], &data[2]) != 0) {
  72. lprintf(LOG_ERR, "Invalid time: %s", argv[1]);
  73. @@ -1933,7 +1933,7 @@ ipmi_lan_alert_set(struct ipmi_intf * intf, uint8_t chan, uint8_t alert,
  74. if (p == NULL) {
  75. return (-1);
  76. }
  77. - memcpy(data, p->data, p->data_len);
  78. + memcpy(data, p->data, __min(p->data_len, sizeof(data)));
  79. if (str2uchar(argv[1], &data[3]) != 0) {
  80. lprintf(LOG_ERR, "Invalid retry: %s", argv[1]);
  81. --
  82. 2.20.1