tree 5268048e32b24b2bac3c8a55f41ef25a0b15ff91
parent eae18d16fefed42af33e63e096a2889b9c70b9cb
author Donald Sharp <sharpd@cumulusnetworks.com> 1453913685 +0000
committer Paul Jakma <paul.jakma@hpe.com> 1455116527 +0000

bgpd: Fix VU#270232, VPNv4 NLRI parser memcpys to stack on unchecked length

Address CERT vulnerability report VU#270232, memcpy to stack data structure
based on length field from packet data whose length field upper-bound was
not properly checked.

This likely allows BGP peers that are enabled to send Labeled-VPN SAFI
routes to Quagga bgpd to remotely exploit Quagga bgpd.

Mitigation: Do not enable Labeled-VPN SAFI with untrusted neighbours.

Impact: Labeled-VPN SAFI is not enabled by default.

* bgp_mplsvpn.c: (bgp_nlri_parse_vpnv4) The prefixlen is checked for
  lower-bound, but not for upper-bound against received data length.
  The packet data is then memcpy'd to the stack based on the prefixlen.

  Extend the prefixlen check to ensure it is within the bound of the NLRI
  packet data AND the on-stack prefix structure AND the maximum size for the
  address family.

Reported-by: Kostya Kortchinsky <kostyak@google.com>

This commit a joint effort between:

Lou Berger <lberger@labn.net>
Donald Sharp <sharpd@cumulusnetworks.com>
Paul Jakma <paul.jakma@hpe.com> / <paul@jakma.org>