Fix remotely-triggerable ASSERT() on malformed IPv6 packet.

Correct sanity checks on IPv6 packet length in mss_fixup_ipv6(), and change the ASSERT() check in mss_fixup_dowork() into a simple "return" (= the TCP header will simply not be inspected further).

CVE-2017-7508 has been assigned due to the serious nature of the
bug: it can be used to remotely shutdown an openvpn server or client, if IPv6 and --mssfix are enabled and the IPv6 networks used inside the VPN are known.

Found by Guido Vranken <[email protected]...>.

v2: style changes

---
 src/openvpn/mss.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

index 51e1ae0..e451350 100644
@@ -120,8 +120,12 @@ mss_fixup_ipv6(struct buffer *buf, int maxmss)
         return;
     }
 
+    /* skip IPv6 header (40 bytes),
+     * verify remainder is large enough to contain a full TCP header
+     */
     newbuf = *buf;
-    if (buf_advance( &newbuf, 40 ) )
+    if (buf_advance( &newbuf, 40 )
+        && BLEN(&newbuf) >= (int) sizeof(struct openvpn_tcphdr))
     {
         struct openvpn_tcphdr *tc = (struct openvpn_tcphdr *) BPTR(&newbuf);
         if (tc->flags & OPENVPN_TCPH_SYN_MASK)

@@ -145,7 +149,10 @@ mss_fixup_dowork(struct buffer *buf, uint16_t maxmss)
     int accumulate;
     struct openvpn_tcphdr *tc;
 
-    ASSERT(BLEN(buf) >= (int) sizeof(struct openvpn_tcphdr));
+    if (BLEN(buf) < (int) sizeof(struct openvpn_tcphdr))
+    {
+	return;
+    }
 
     verify_align_4(buf);
     tc = (struct openvpn_tcphdr *) BPTR(buf);

2.10.2

Patch has been applied to the master, release/2.4 and release/2.3 branch.

commit c3f47077a7756de5929094569421a95aa66f2022 (master) commit ed28cde3d8bf3f1459b2f42f0e27d64801009f92 (release/2.4) commit fc61d1bda112ffc669dbde961fab19f60b3c7439 (release/2.3)

Author: Gert Doering
Date:   Tue Jun 13 22:08:32 2017 +0200

     Fix remotely-triggerable ASSERT() on malformed IPv6 packet.

     Signed-off-by: Gert Doering <[email protected]...>
     Acked-by: Steffan Karger <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/search?l=mid&[email protected]...
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering