From patchwork Wed Jun 21 22:07:44 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Korsgaard X-Patchwork-Id: 779190 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3wtJkf6Bxzz9s0Z for ; Thu, 22 Jun 2017 08:08:26 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="R9DecaVN"; dkim-atps=neutral Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id 5C58487870; Wed, 21 Jun 2017 22:08:25 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YzJ8WQtLPJDf; Wed, 21 Jun 2017 22:08:17 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by whitealder.osuosl.org (Postfix) with ESMTP id 98CEF8776A; Wed, 21 Jun 2017 22:08:13 +0000 (UTC) X-Original-To: buildroot@lists.busybox.net Delivered-To: buildroot@osuosl.org Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by ash.osuosl.org (Postfix) with ESMTP id 3B7461C1190 for ; Wed, 21 Jun 2017 22:08:05 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 3776587220 for ; Wed, 21 Jun 2017 22:08:05 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id No3YxdSyq2Wc for ; Wed, 21 Jun 2017 22:08:04 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail-wr0-f194.google.com (mail-wr0-f194.google.com [209.85.128.194]) by fraxinus.osuosl.org (Postfix) with ESMTPS id 2F76687232 for ; Wed, 21 Jun 2017 22:08:04 +0000 (UTC) Received: by mail-wr0-f194.google.com with SMTP id k67so2224547wrc.1 for ; Wed, 21 Jun 2017 15:08:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references; bh=XUmds6iHOcVWH/o2C69xf/UeFdV4euod7aBuV1m7nZE=; b=R9DecaVNtUC6cYrOlNSjErXKvEVCC5tTHBsaq9W5Fh0lQbQWgAo9AQSKXNi1o+mAWL Sd1JvamAmabXeVR7Iovr9N5wy+gNml9DuhIh0GugOZNWnphULdH4m/LN4FgMm4yES1P/ yBS6BkR6FevSx2A3Uz80o5eg4EfcflyxVe9yZ7kfcBxk7pgvYALUdJr80FRya+zFqEv/ rP13YUPncswtZlJitu/xs868g0RHKd02okEIvTp0D9ZObcWwjfhSG7n6W9IP0WjBP9UL 2EhhtyTr66b+HiXcLrPsblwwDkwB6InbPblDcVQ3tmOn49at4wxj14lvlXWN7sWFCRk2 5/OA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references; bh=XUmds6iHOcVWH/o2C69xf/UeFdV4euod7aBuV1m7nZE=; b=o1Nteup0BN99UtN5Nwflt9yy/YCuKyhiky1nnNTi98d1n6MFSvsfb8ZlSaGma/EBgR Vh0ecO03H2FYc9ddBIGMvAvMAbo11SoQhA9LyZe9LZjx+Ubeq6TZFpmmI256MsTaD1hP 2COEDJAnzU5leiKclUVTJ7RRmYUCGL+Fxx/tTSF/cZ2Lk1LTF+2V8FQWY95NoM0get6k z09OdBw9tl9uN/weo+7kbRJz/67Ik9w6lIBQj14XXCfv8x5TJqsrcsQt2xePf0J5wvGu jAJ0inLD5mhWL+RSy9J1pTr/0HUiDcmGs+7T4vTtfQ/3aMLS6nwg2+zfA/ZVp0qWiQVj voYw== X-Gm-Message-State: AKS2vOxZgvOGcBo0x7f534O1kMW9+fKBuIWNtTEUpahOdg3FwdKHsRzk 2NqPkk8T2U/qOoAywTY= X-Received: by 10.80.137.36 with SMTP id e33mr2561ede.67.1498082882242; Wed, 21 Jun 2017 15:08:02 -0700 (PDT) Received: from dell.be.48ers.dk (d51a5bc31.access.telenet.be. [81.165.188.49]) by smtp.gmail.com with ESMTPSA id c35sm7176eda.13.2017.06.21.15.07.59 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Wed, 21 Jun 2017 15:08:00 -0700 (PDT) Received: from peko by dell.be.48ers.dk with local (Exim 4.88) (envelope-from ) id 1dNnn5-0004vu-Ib; Thu, 22 Jun 2017 00:07:59 +0200 From: Peter Korsgaard To: buildroot@buildroot.org Date: Thu, 22 Jun 2017 00:07:44 +0200 Message-Id: <20170621220744.18908-5-peter@korsgaard.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20170621220744.18908-1-peter@korsgaard.com> References: <20170621220744.18908-1-peter@korsgaard.com> Cc: yann.morin.1998@free.fr Subject: [Buildroot] [PATCH 4/4] spice: add post-0.12.8 upstream security fixes X-BeenThere: buildroot@busybox.net X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Discussion and development of buildroot List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: buildroot-bounces@busybox.net Sender: "buildroot" Fixes the following security issues: CVE-2016-9577 Frediano Ziglio of Red Hat discovered a buffer overflow vulnerability in the main_channel_alloc_msg_rcv_buf function. An authenticated attacker can take advantage of this flaw to cause a denial of service (spice server crash), or possibly, execute arbitrary code. CVE-2016-9578 Frediano Ziglio of Red Hat discovered that spice does not properly validate incoming messages. An attacker able to connect to the spice server could send crafted messages which would cause the process to crash. Signed-off-by: Peter Korsgaard Reviewed-by: "Yann E. MORIN" --- ...sible-DoS-attempts-during-protocol-handsh.patch | 60 ++++++++++++++++++++++ ...nt-integer-overflows-in-capability-checks.patch | 43 ++++++++++++++++ ...l-Prevent-overflow-reading-messages-from-.patch | 33 ++++++++++++ 3 files changed, 136 insertions(+) create mode 100644 package/spice/0001-Prevent-possible-DoS-attempts-during-protocol-handsh.patch create mode 100644 package/spice/0002-Prevent-integer-overflows-in-capability-checks.patch create mode 100644 package/spice/0003-main-channel-Prevent-overflow-reading-messages-from-.patch diff --git a/package/spice/0001-Prevent-possible-DoS-attempts-during-protocol-handsh.patch b/package/spice/0001-Prevent-possible-DoS-attempts-during-protocol-handsh.patch new file mode 100644 index 0000000000..57a64d96b7 --- /dev/null +++ b/package/spice/0001-Prevent-possible-DoS-attempts-during-protocol-handsh.patch @@ -0,0 +1,60 @@ +From 1c6517973095a67c8cb57f3550fc1298404ab556 Mon Sep 17 00:00:00 2001 +From: Frediano Ziglio +Date: Tue, 13 Dec 2016 14:39:48 +0000 +Subject: [PATCH] Prevent possible DoS attempts during protocol handshake + +The limit for link message is specified using a 32 bit unsigned integer. +This could cause possible DoS due to excessive memory allocations and +some possible crashes. +For instance a value >= 2^31 causes a spice_assert to be triggered in +async_read_handler (reds-stream.c) due to an integer overflow at this +line: + + int n = async->end - async->now; + +This could be easily triggered with a program like + + #!/usr/bin/env python + + import socket + import time + from struct import pack + + server = '127.0.0.1' + port = 5900 + + s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + s.connect((server, port)) + data = pack('<4sIII', 'REDQ', 2, 2, 0xaaaaaaaa) + s.send(data) + + time.sleep(1) + +without requiring any authentication (the same can be done +with TLS). + +[Peter: fixes CVE-2016-9578] +Signed-off-by: Frediano Ziglio +Acked-by: Christophe Fergeau +Signed-off-by: Peter Korsgaard +--- + server/reds.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/server/reds.c b/server/reds.c +index f40b65c1..86a33d53 100644 +--- a/server/reds.c ++++ b/server/reds.c +@@ -2202,7 +2202,8 @@ static void reds_handle_read_header_done(void *opaque) + + reds->peer_minor_version = header->minor_version; + +- if (header->size < sizeof(SpiceLinkMess)) { ++ /* the check for 4096 is to avoid clients to cause arbitrary big memory allocations */ ++ if (header->size < sizeof(SpiceLinkMess) || header->size > 4096) { + reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA); + spice_warning("bad size %u", header->size); + reds_link_free(link); +-- +2.11.0 + diff --git a/package/spice/0002-Prevent-integer-overflows-in-capability-checks.patch b/package/spice/0002-Prevent-integer-overflows-in-capability-checks.patch new file mode 100644 index 0000000000..5bf9b89d17 --- /dev/null +++ b/package/spice/0002-Prevent-integer-overflows-in-capability-checks.patch @@ -0,0 +1,43 @@ +From f66dc643635518e53dfbe5262f814a64eec54e4a Mon Sep 17 00:00:00 2001 +From: Frediano Ziglio +Date: Tue, 13 Dec 2016 14:40:10 +0000 +Subject: [PATCH] Prevent integer overflows in capability checks + +The limits for capabilities are specified using 32 bit unsigned integers. +This could cause possible integer overflows causing buffer overflows. +For instance the sum of num_common_caps and num_caps can be 0 avoiding +additional checks. +As the link message is now capped to 4096 and the capabilities are +contained in the link message limit the capabilities to 1024 +(capabilities are expressed in number of uint32_t items). + +[Peter: fixes CVE-2016-9578] +Signed-off-by: Frediano Ziglio +Acked-by: Christophe Fergeau +Signed-off-by: Peter Korsgaard +--- + server/reds.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/server/reds.c b/server/reds.c +index 86a33d53..91504544 100644 +--- a/server/reds.c ++++ b/server/reds.c +@@ -2110,6 +2110,14 @@ static void reds_handle_read_link_done(void *opaque) + link_mess->num_channel_caps = GUINT32_FROM_LE(link_mess->num_channel_caps); + link_mess->num_common_caps = GUINT32_FROM_LE(link_mess->num_common_caps); + ++ /* Prevent DoS. Currently we defined only 13 capabilities, ++ * I expect 1024 to be valid for quite a lot time */ ++ if (link_mess->num_channel_caps > 1024 || link_mess->num_common_caps > 1024) { ++ reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA); ++ reds_link_free(link); ++ return; ++ } ++ + num_caps = link_mess->num_common_caps + link_mess->num_channel_caps; + caps = (uint32_t *)((uint8_t *)link_mess + link_mess->caps_offset); + +-- +2.11.0 + diff --git a/package/spice/0003-main-channel-Prevent-overflow-reading-messages-from-.patch b/package/spice/0003-main-channel-Prevent-overflow-reading-messages-from-.patch new file mode 100644 index 0000000000..f602d5f3b1 --- /dev/null +++ b/package/spice/0003-main-channel-Prevent-overflow-reading-messages-from-.patch @@ -0,0 +1,33 @@ +From 5f96b596353d73bdf4bb3cd2de61e48a7fd5b4c3 Mon Sep 17 00:00:00 2001 +From: Frediano Ziglio +Date: Tue, 29 Nov 2016 16:46:56 +0000 +Subject: [PATCH] main-channel: Prevent overflow reading messages from client + +Caller is supposed the function return a buffer able to store +size bytes. + +[Peter: fixes CVE-2016-9577] +Signed-off-by: Frediano Ziglio +Acked-by: Christophe Fergeau +Signed-off-by: Peter Korsgaard +--- + server/main_channel.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/server/main_channel.c b/server/main_channel.c +index 0ecc9df8..1fc39155 100644 +--- a/server/main_channel.c ++++ b/server/main_channel.c +@@ -1026,6 +1026,9 @@ static uint8_t *main_channel_alloc_msg_rcv_buf(RedChannelClient *rcc, + + if (type == SPICE_MSGC_MAIN_AGENT_DATA) { + return reds_get_agent_data_buffer(mcc, size); ++ } else if (size > sizeof(main_chan->recv_buf)) { ++ /* message too large, caller will log a message and close the connection */ ++ return NULL; + } else { + return main_chan->recv_buf; + } +-- +2.11.0 +