Project

General

Profile

Actions
Copy link

Bug #6787

closed
PA PA

decode/pppoe: Suspicious pointer scaling

Bug #6787: decode/pppoe: Suspicious pointer scaling

Added by Philippe Antoine about 2 years ago. Updated about 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
8.0.0-beta1
Affected Versions:
8.0.0-beta1
Effort:
Difficulty:
Label:

Description

pppoedt = pppoedt + (4 + tag_length);. looks like it can overflow on 32-bits system

Subtasks 2 (0 open — 2 closed)

Bug #6809: decode/pppoe: Suspicious pointer scaling (6.0.x backport)RejectedPhilippe AntoineActions
Bug #6810: decode/pppoe: Suspicious pointer scaling (7.0.x backport)ClosedPhilippe AntoineActions

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
 #2

  • Status changed from New to In Review

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
 #3

  • Tracker changed from Security to Bug
  • Private changed from Yes to No
  • Severity deleted (MODERATE)

Actually, this is a bug, but not a security issue.

There is no unsigned overflow because we upgrade a u16 read on the network to u32

But there is still the bug that we do pointer arithmetic with something different than the u8 pkt buffer...

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
 #4

  • Target version changed from TBD to 8.0.0-beta1

OT Updated by OISF Ticketbot about 2 years ago Actions
Copy link
 #5

  • Subtask #6809 added

OT Updated by OISF Ticketbot about 2 years ago Actions
Copy link
 #6

  • Label deleted (Needs backport to 6.0)

OT Updated by OISF Ticketbot about 2 years ago Actions
Copy link
 #7

  • Subtask #6810 added

OT Updated by OISF Ticketbot about 2 years ago Actions
Copy link
 #8

  • Label deleted (Needs backport to 7.0)

VJ Updated by Victor Julien about 2 years ago Actions
Copy link
 #9

  • Subject changed from decode/ppoe: Suspicious pointer scaling to decode/pppoe: Suspicious pointer scaling

@Philippe Antoine can you fix the title of the backport tickets?

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
 #10

Victor Julien wrote in #note-9:

catenacyber can you fix the title of the backport tickets?

Had to look twice at the diff to see it :-p

VJ Updated by Victor Julien about 2 years ago Actions
Copy link
 #11

Off by one I guess ;)

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
 #12

  • Status changed from In Review to Resolved

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
 #13

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: PDF Atom