Bug 1316571 – CVE-2016-2342 quagga: VPNv4 NLRI parser memcpys to stack on unchecked length

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1316571 - (CVE-2016-2342) CVE-2016-2342 quagga: VPNv4 NLRI parser memcpys to stack on unchecked length

Summary:	CVE-2016-2342 quagga: VPNv4 NLRI parser memcpys to stack on unchecked length

Status:	NEW

Aliases:	CVE-2016-2342

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20160309,repor...
Keywords:	Reopened, Security

Depends On:	1316572 1391916
Blocks:	1316575 1386080
	Show dependency tree / graph

Reported:	2016-03-10 09:03 EST by Andrej Nemec
Modified:	2018-03-29 17:58 EDT (History)
CC List:	4 users (show)

See Also:
Fixed In Version:	quagga 1.0.20160309
Doc Type:	Bug Fix
Doc Text:	A stack-based buffer overflow flaw was found in the way the Quagga BGP routing daemon (bgpd) handled Labeled-VPN SAFI routes data. A remote attacker could use this flaw to crash the bgpd daemon resulting in denial of service.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2016-05-27 04:57:48 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2017:0794	normal	SHIPPED_LIVE	Moderate: quagga security and bug fix update	2017-03-21 08:50:48 EDT

Groups: None (edit)

Description Andrej Nemec 2016-03-10 09:03:48 EST

bgpd: Fix VU#270232, VPNv4 NLRI parser memcpys to stack on unchecked length
    
A vulnerability was found in a way VPNv4 NLRI parser copied packet data to the stack. Memcpy to stack data structure based on length field from packet data whose length field upper-bound was not properly checked.
    
This likely allows BGP peers that are enabled to send Labeled-VPN SAFI routes to Quagga bgpd to remotely exploit Quagga bgpd.
    
Mitigation: Do not enable Labeled-VPN SAFI with untrusted neighbours.
    
Impact: Labeled-VPN SAFI is not enabled by default.
    
* bgp_mplsvpn.c: (bgp_nlri_parse_vpnv4) The prefixlen is checked for
  lower-bound, but not for upper-bound against received data length.
  The packet data is then memcpy'd to the stack based on the prefixlen.
    
  Extend the prefixlen check to ensure it is within the bound of the NLRI
  packet data AND the on-stack prefix structure AND the maximum size for the
  address family.

Upstream fix:

http://git.savannah.gnu.org/cgit/quagga.git/commit/?id=a3bc7e9400b214a0f078fdb19596ba54214a1442

External references:

http://mirror.easyname.at/nongnu//quagga/quagga-1.0.20160309.changelog.txt

Comment 1 Andrej Nemec 2016-03-10 09:04:27 EST

Created quagga tracking bugs for this issue:

Affects: fedora-all [bug 1316572]

Comment 2 Andrej Nemec 2016-03-14 06:44:24 EDT

References:

https://www.kb.cert.org/vuls/id/270232

Comment 4 errata-xmlrpc 2017-03-21 07:58:35 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:0794 https://rhn.redhat.com/errata/RHSA-2017-0794.html

Note You need to log in before you can comment on or make changes to this bug.