Bug 1655374 (CVE-2018-19519)

Summary:	CVE-2018-19519 tcpdump: Stack-based buffer over-read in print-hncp.c:print_prefix() via crafted pcap
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	abhgupta, apmukher, darunesh, dbaker, jokerman, luhliari, mlichvar, mruprich, msehnout, msekleta, sthangav, thozza, trankin
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-11-26 19:04:49 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1655621, 1655622, 1761349
Bug Blocks:	1655376, 1735552

Description Sam Fowler 2018-12-03 03:55:06 UTC

In tcpdump 4.9.2, a stack-based buffer over-read exists in the print_prefix function of print-hncp.c via crafted packet data because of missing initialization.


Reference:

https://github.com/zyingp/temp/blob/master/tcpdump.md

Comment 1 Sam Fowler 2018-12-03 04:00:47 UTC

Could not reproduce with tcpdump-4.9.2-6.fc29.i686:

$ ldd $(which tcpdump) | grep asan
        libasan.so.5 => /lib/libasan.so.5 (0xf7575000)
$ tcpdump -ee -vv -nnr id_57.pcap
reading from file id_57.pcap, link-type EN10MB (Ethernet)
07:52:49.784807 08:00:25:d4:10:bb > 08:00:27:10:8f:95, ethertype IPv6 (0x86dd), length 16: truncated-ip6 2
07:52:49.892740 08:00:27:da:8f:95 > 33:33:00:00:ff:fe, ethertype IPv6 (0x86dd), length 32929: truncated-ip6 - 32511 bytes missing!(flowlabel 0x0fdff, hlim 0, next-header UDP (17) payload length: 65386) 80ff:ff00::a00:6873:7570:6c6f.8231 > 7274:a43:6f70:7972:6967:6874:3328:6329.14648: hncp (13861)
        Future use: type=13312 (12)
        Unassigned: type=128 (4)
        Assigned-Prefix (48) EPID: ff000000 Prty: 5 Prefix: ��V�2���  (invalid)
        Reserved: type=0 (20)
        Future use: type=12 (14)
        [|hncp]
tcpdump: pcap_loop: truncated dump file; tried to read 8 bytes, only got 4

Comment 2 Stefan Cornelius 2018-12-03 15:09:00 UTC

Statement:

This issue affects the versions of tcpdump as shipped with Red Hat Enterprise Linux 7.

This issue did not affect the versions of tcpdump as shipped with Red Hat Enterprise Linux 5 and 6.

Comment 6 Stefan Cornelius 2019-08-07 10:16:13 UTC

*** Bug 1735549 has been marked as a duplicate of this bug. ***

Comment 7 errata-xmlrpc 2019-11-26 13:58:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:3976 https://access.redhat.com/errata/RHSA-2019:3976

Comment 8 Product Security DevOps Team 2019-11-26 19:04:49 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-19519

Comment 9 errata-xmlrpc 2020-04-28 15:28:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1604 https://access.redhat.com/errata/RHSA-2020:1604