Bug 1966240 (CVE-2021-3570) - CVE-2021-3570 linuxptp: missing length check of forwarded messages
Summary: CVE-2021-3570 linuxptp: missing length check of forwarded messages
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-3570
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1966504 1966505 1966506 1966507 1966516 1966524 1979399
Blocks: 1966236 1966242
TreeView+ depends on / blocked
 
Reported: 2021-05-31 17:28 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-04-17 21:25 UTC (History)
4 users (show)

Fixed In Version: linuxptp 3.1.1, linuxptp 2.0.1, linuxptp 1.9.3, linuxptp 1.8.1, linuxptp 1.7.1, linuxptp 1.6.1, linuxptp 1.5.1
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Clone Of:
Environment:
Last Closed: 2021-07-06 16:40:27 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:2657 0 None None None 2021-07-06 15:37:30 UTC
Red Hat Product Errata RHSA-2021:2658 0 None None None 2021-07-06 16:05:41 UTC
Red Hat Product Errata RHSA-2021:2659 0 None None None 2021-07-06 15:21:34 UTC
Red Hat Product Errata RHSA-2021:2660 0 None None None 2021-07-06 15:41:07 UTC

Description Guilherme de Almeida Suckevicz 2021-05-31 17:28:48 UTC 
When ptp4l is forwarding a PTP message between ports, it uses the messageLength field as the length of transmitted data, but it does not check if the value is not larger than the actual length of the received message. An attacker with access to the network can send a crafted message to cause ptp4l to send data past the message buffer, causing an information leak or crash. If ptp4l runs on a little-endian architecture, the attacker can also craft a management message which causes a heap memory corruption by converting fields from host to network order, potentially leading to remote code execution.
Comment 5 Mauro Matteo Cascella 2021-07-05 21:33:07 UTC 
Upstream fix:
https://sourceforge.net/p/linuxptp/code/ci/a1e63aa3a7304647913707c4df01f3df430806ab [master]
https://sourceforge.net/p/linuxptp/code/ci/ce15e4de5926724557e8642ec762a210632f15ca [v3.1.1]
https://sourceforge.net/p/linuxptp/code/ci/943ff3591412c232e6499ee9ddb846ef1a62bd4b [v2.0.1]
https://sourceforge.net/p/linuxptp/code/ci/c15da0756d9b0ad9c0b9307c4a8685b490b76485 [v1.9.3]
https://sourceforge.net/p/linuxptp/code/ci/7795df89dd4f94e0f55959dc61a85535d0f01cae [v1.8.1]
https://sourceforge.net/p/linuxptp/code/ci/4a9eefe0066af7de94685d84150e00d2107423dd [v1.7.1]
https://sourceforge.net/p/linuxptp/code/ci/7316ed7e5bf7998860246bc9c915cedc1b2e3f1a [v1.6.1]
https://sourceforge.net/p/linuxptp/code/ci/77e7abd7e9b0f480372989848541ddf8cb0350aa [v1.5.1]
Comment 6 Mauro Matteo Cascella 2021-07-05 21:33:27 UTC 
Created linuxptp tracking bugs for this issue:

Affects: fedora-all [bug 1979399]
Comment 7 Mauro Matteo Cascella 2021-07-06 07:37:14 UTC 
The length of a PTP message is determined by the message type and the appended TLVs. The current implementation validates the sizes of both the main message (according to the fixed header length and fixed length by type) and the TLVs (by using the 'L' of the TLV).

However, when forwarding a message, the messageLength field is used. If a message arrives with a messageLength field larger than the actual
message size, the code will read and possibly write data beyond the allocated buffer.
Comment 9 errata-xmlrpc 2021-07-06 15:21:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:2659 https://access.redhat.com/errata/RHSA-2021:2659
Comment 10 errata-xmlrpc 2021-07-06 15:37:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:2657 https://access.redhat.com/errata/RHSA-2021:2657
Comment 11 errata-xmlrpc 2021-07-06 15:41:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:2660 https://access.redhat.com/errata/RHSA-2021:2660
Comment 12 errata-xmlrpc 2021-07-06 16:05:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:2658 https://access.redhat.com/errata/RHSA-2021:2658
Comment 13 Product Security DevOps Team 2021-07-06 16:40:27 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3570
Comment 14 Product Security DevOps Team 2021-07-06 22:40:20 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3570
Note You need to log in before you can comment on or make changes to this bug.