Skip to contentSkip to conversation

quagga: add upstream security fix for CVE-2017-16227

PATCH New Peter Korsgaard 2 participants 3 messages Oct 30, 2017 – Nov 26, 2017

lore
Share & tools
lore

Peter Korsgaard

author
#0 lore raw

PATCH 1/1 quagga: add upstream security fix for CVE-2017-16227

From the advisory:
http://www.openwall.com/lists/oss-security/2017/10/30/4

It was discovered that the bgpd daemon in the Quagga routing suite does not properly calculate the length of multi-segment AS_PATH UPDATE messages, causing bgpd to drop a session and potentially resulting in loss of network connectivity.

Signed-off-by Peter Korsgaard <[email protected]>
---
 ...x-AS_PATH-size-calculation-for-long-paths.patch | 33 ++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 package/quagga/0004-bgpd-Fix-AS_PATH-size-calculation-for-long-paths.patch
package/quagga/0004-bgpd-Fix-AS_PATH-size-calculation-for-long-paths.patch new file +33 -0
new file mode 100644
index 0000000000..1425cf0426
@@ -0,0 +1,33 @@
+From 7a42b78be9a4108d98833069a88e6fddb9285008 Mon Sep 17 00:00:00 2001
+From: Andreas Jaggi <[email protected]>
+Date: Mon, 2 Oct 2017 19:38:43 +0530
+Subject: [PATCH] bgpd: Fix AS_PATH size calculation for long paths
+
+If you have an AS_PATH with more entries than
+what can be written into a single AS_SEGMENT_MAX
+it needs to be broken up.  The code that noticed
+that the AS_PATH needs to be broken up was not
+correctly calculating the size of the resulting
+message.  This patch addresses this issue.
+
+Signed-off-by: Peter Korsgaard <[email protected]>
+---
+ bgpd/bgp_aspath.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bgpd/bgp_aspath.c b/bgpd/bgp_aspath.c
+index b7af5e88..d813bfba 100644
+--- a/bgpd/bgp_aspath.c
++++ b/bgpd/bgp_aspath.c
+@@ -903,7 +903,7 @@ aspath_put (struct stream *s, struct aspath *as, int use32bit )
+               assegment_header_put (s, seg->type, AS_SEGMENT_MAX);
+               assegment_data_put (s, seg->as, AS_SEGMENT_MAX, use32bit);
+               written += AS_SEGMENT_MAX;
+-              bytes += ASSEGMENT_SIZE (written, use32bit);
++              bytes += ASSEGMENT_SIZE (AS_SEGMENT_MAX, use32bit);
+             }
+           
+           /* write the final segment, probably is also the first */
+-- 
+2.11.0
+
Signature · 1 line
2.11.0
Applied
#1 lore raw

PATCH 1/1 quagga: add upstream security fix for CVE-2017-16227

Hello,

Quoted 8 lines · Peter Korsgaard

From the advisory:
http://www.openwall.com/lists/oss-security/2017/10/30/4

It was discovered that the bgpd daemon in the Quagga routing suite does not properly calculate the length of multi-segment AS_PATH UPDATE messages, causing bgpd to drop a session and potentially resulting in loss of network connectivity.

Quoted 5 lines
Signed-off-by Peter Korsgaard <[email protected]>
---
 ...x-AS_PATH-size-calculation-for-long-paths.patch | 33 ++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 package/quagga/0004-bgpd-Fix-AS_PATH-size-calculation-for-long-paths.patch

Applied to master, thanks.

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com
author
#2 lore raw

PATCH 1/1 quagga: add upstream security fix for CVE-2017-16227

In reply to Peter Korsgaard
Quoted 11 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

From the advisory:
http://www.openwall.com/lists/oss-security/2017/10/30/4

It was discovered that the bgpd daemon in the Quagga routing suite does not properly calculate the length of multi-segment AS_PATH UPDATE messages, causing bgpd to drop a session and potentially resulting in loss of network connectivity.

Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2017.02.x and 2017.08.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard