Don't assert out on receiving too-large control packets (CVE-2017-7478)
PATCH 1/1 Don't assert out on receiving too-large control packets (CVE-2017-7478)
Commit 358f513c changed the maximum size of accepted control channel packets. This was needed for crypto negotiation (which is needed for a nice transition to a new default cipher), but exposed a DoS vulnerability. The vulnerability was found during the OpenVPN 2.4 code audit by Quarkslab (commisioned by OSTIF).
To fix the issue, we should not ASSERT() on external input (in this case the received packet size), but instead gracefully error out and drop the invalid packet.
--- Changes.rst | 5 +++++ src/openvpn/ssl.c | 7 ++++++- 2 files changed, 11 insertions(+), 1 deletion(-)
Changes.rst +5 -0
@@ -109,6 +109,11 @@ Version 2.3.15 Security fixes -------------- +- Fix a pre-authentication denial-of-service attack on both clients and servers. + By sending a too-large control packet, OpenVPN 2.3.12 and newer can be forced + to hit an ASSERT() and stop the process. If ``--tls-auth`` or ``--tls-crypt`` + is used, only attackers that have the ``--tls-auth`` or ``--tls-crypt`` key + can mount an attack. (OSTIF/Quarkslab audit finding 5.1, CVE-2017-7478) - Fix an authenticated remote DoS vulnerability that could be triggered by causing a packet id roll over. An attack is rather inefficient; a peer would need to get us to send at least about 196 GB of data.
src/openvpn/ssl.c +6 -1
@@ -3228,7 +3228,12 @@ tls_pre_decrypt (struct tls_multi *multi,/* Save incoming ciphertext packet to reliable buffer */ struct buffer *in =reliable_get_buf (ks->rec_reliable);ASSERT (in); -ASSERT (buf_copy (in, buf)); +if (!buf_copy (in, buf)) + { +msg (D_MULTI_DROPPED , +"Incoming control channel packet too big, dropping." ); + goto error; + }reliable_mark_active_incoming (ks->rec_reliable, in, id, op); }
Signature · 1 line
2.7.4
Hi,
Quoted 21 lines · Steffan Karger
Commit
358f513cchanged the maximum size of accepted control channel packets. This was needed for crypto negotiation (which is needed for a nice transition to a new default cipher), but exposed a DoS vulnerability. The vulnerability was found during the OpenVPN 2.4 code audit by Quarkslab (commisioned by OSTIF).To fix the issue, we should not
ASSERT()on external input (in this case the received packet size), but instead gracefully error out and drop the invalid packet.Signed-off-by Steffan Karger <[email protected]...>--- Changes.rst | 5 +++++ src/openvpn/ssl.c | 7 ++++++- 2 files changed, 11 insertions(+), 1 deletion(-)Changes.rst +0
-0
Changes.rst Version 2.3.15 · line 115
Quoted 7 lines
Changes.rst +4
-0@@ -109,6 +109,11 @@ Version 2.3.15 Security fixes -------------- +- Fix a pre-authentication denial-of-service attack on both clients and servers. + By sending a too-large control packet, OpenVPN 2.3.12 and newer can be forced + to hit an ASSERT() and stop the process. If ``--tls-auth`` or ``--tls-crypt`` + is used, only attackers that have the ``--tls-auth`` or ``--tls-crypt`` key
When applying, please remove the "--tls-crypt" reference as 2.3 does not have this (so it's confusing at best).
Quoted 11 lines
Changes.rst +1
-0+ can mount an attack. (OSTIF/Quarkslab audit finding 5.1, CVE-2017-7478) - Fix an authenticated remote DoS vulnerability that could be triggered by causing a packet id roll over. An attack is rather inefficient; a peer would need to get us to send at least about 196 GB of data.src/openvpn/ssl.c +0
-0@@ -3228,7 +3228,12 @@ tls_pre_decrypt (struct tls_multi *multi,/* Save incoming ciphertext packet to reliable buffer */ struct buffer *in =reliable_get_buf (ks->rec_reliable);
src/openvpn/ssl.c tls_pre_decrypt (struct tls_multi *multi, · line 3238
Quoted 10 lines
src/openvpn/ssl.c +6
-1ASSERT (in); -ASSERT (buf_copy (in, buf)); +if (!buf_copy (in, buf)) + { +msg (D_MULTI_DROPPED , +"Incoming control channel packet too big, dropping." ); + goto error; + }reliable_mark_active_incoming (ks->rec_reliable, in, id, op); }
ACK. Same patch as in 2.4+master.
gert
Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]...
fax: +49-89-35655025 [email protected]...-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
ACK from me as well on this one. As Gert already said, patch is identical to what we applied in master and release/2.4.
The Changes.rst file was updated on-the-fly, removing references to tls-crypt, which isn't available in the v2.3 releases.
Your patch has been applied to the branch
commit feb35ee5cac605edddd6e9dc62941e2c53f96fb3
Author: Steffan Karger Date: Thu May 11 11:00:57 2017 +0200
Don't assert out on receiving too-large control packets (CVE-2017-7478)
CVE: 2017-7478
Signed-off-by: Steffan Karger <[email protected]...>
Acked-by: Gert Doering <[email protected]...>
Acked-by: David Sommerseth <[email protected]...>
Message-Id: <[email protected]...>
URL: http://www.mail-archive.com/search?l=mid&[email protected]...
Signed-off-by: David Sommerseth <[email protected]...>- --
kind regards,
David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBCAAGBQJZFJO6AAoJEIbPlEyWcf3yygkP/0fXxoxHtE+cGLA4ts+dqhsC /zGDm5JuJox5hLIm4BN88vtLCRJTXlQ+JyvQw4n7LWhrqaNCuWMPR1Q3f+di3734 0ltIH6IyTmfPZbdL/2Zd2SnMIDDhuJ6M+D3Vs3ZfN+uP6mRPsaEsSekJ1gsj4wC3 6Pcl3yi/6sI5k8aCFFNvLRaAUv5/XngQxcJa4b6TAqO7ADQ/Fd5URv6Xkvw7269U GCbDYL8h92dwOuhGFgF/mi02MmKP8Qz78CxIPQNjmR+3PB5hhsnepUf6YxoabMcx tjT0sVlJ6+kcc1Ot0pNP3r5xXhIWPrJOXxX5rMvW7lb0esYZe8vD1fh2NmhdcKwv ngjvk5Eb2u4oRsjYQy+kdwivuI9fGppqNFFsyU1LG1LhO5Xtlip5pwSQeCxRscUE aJkQS+Y0DF4MfrJYP/0hr97Sabk5cm1kIXJ+EQri89Sqa8uB4EH26t2Wy0dS6DcA U/Dhtk1HVQ/bjV9mQoQgarNZc51FvOQJUagP1s76JPOIl0L7LQefs7ZcmFYGBJ2q MnXtWZH37C3lCUm/33lHIs9darbRHcqJPKjECU/7xjRRUdPcuy6L6WcLSptO4u4g un3lRuu5/hlx9f1P6dMxtRpd1Nd/oWwcNRSzc4K9byr7wuR74NGbWRmbHwB2gLKi PrH002aRQraZzmKSMZQf
=OjWV
-----END PGP SIGNATURE-----