File lanp-Fix-buffer-overflows-in-get_lan_param_sele... of Package ipmitool.14091

Overview Repositories Revisions Requests Users Attributes Meta

File lanp-Fix-buffer-overflows-in-get_lan_param_select.patch of Package ipmitool.14091

From: Chrostoper Ertl <chertl@microsoft.com>
Subject: lanp: Fix buffer overflows in get_lan_param_select
References: bsc#1163026, CVE-2020-5208
Patch-Mainline: 
Git-commit: d45572d71e70840e0d4c50bf48218492b79c1a10
Git-repo: https://github.com/ipmitool/ipmitool.git.git

Partial fix for CVE-2020-5208, see
https://github.com/ipmitool/ipmitool/security/advisories/GHSA-g659-9qxw-p7cp

The `get_lan_param_select` function is missing a validation check on the
response’s `data_len`, which it then returns to caller functions, where
stack buffer overflow can occur.

Signed-off-by:  <trenn@suse.com>
---
 lib/ipmi_lanp.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

--- a/lib/ipmi_lanp.c
+++ b/lib/ipmi_lanp.c
@@ -1806,7 +1806,7 @@
 		if (!p) {
 			return (-1);
 		}
-		memcpy(data, p->data, p->data_len);
+		memcpy(data, p->data, __min(p->data_len, sizeof(data)));
 		/* set new ipaddr */
 		memcpy(data+3, temp, 4);
 		printf("Setting LAN Alert %d IP Address to %d.%d.%d.%d\n", alert,
@@ -1821,7 +1821,7 @@
 		if (!p) {
 			return (-1);
 		}
-		memcpy(data, p->data, p->data_len);
+		memcpy(data, p->data, __min(p->data_len, sizeof(data)));
 		/* set new macaddr */
 		memcpy(data+7, temp, 6);
 		printf("Setting LAN Alert %d MAC Address to "
@@ -1835,7 +1835,7 @@
 		if (!p) {
 			return (-1);
 		}
-		memcpy(data, p->data, p->data_len);
+		memcpy(data, p->data, __min(p->data_len, sizeof(data)));
 
 		if (strncasecmp(argv[1], "def", 3) == 0 ||
 		    strncasecmp(argv[1], "default", 7) == 0) {
@@ -1861,7 +1861,7 @@
 		if (!p) {
 			return (-1);
 		}
-		memcpy(data, p->data, p->data_len);
+		memcpy(data, p->data, __min(p->data_len, sizeof(data)));
 
 		if (strncasecmp(argv[1], "on", 2) == 0 ||
 		    strncasecmp(argv[1], "yes", 3) == 0) {
@@ -1886,7 +1886,7 @@
 		if (!p) {
 			return (-1);
 		}
-		memcpy(data, p->data, p->data_len);
+		memcpy(data, p->data, __min(p->data_len, sizeof(data)));
 
 		if (strncasecmp(argv[1], "pet", 3) == 0) {
 			printf("Setting LAN Alert %d destination to PET Trap\n", alert);
@@ -1914,7 +1914,7 @@
 		if (!p) {
 			return (-1);
 		}
-		memcpy(data, p->data, p->data_len);
+		memcpy(data, p->data, __min(p->data_len, sizeof(data)));
 
 		if (str2uchar(argv[1], &data[2]) != 0) {
 			lprintf(LOG_ERR, "Invalid time: %s", argv[1]);
@@ -1930,7 +1930,7 @@
 		if (!p) {
 			return (-1);
 		}
-		memcpy(data, p->data, p->data_len);
+		memcpy(data, p->data, __min(p->data_len, sizeof(data)));
 
 		if (str2uchar(argv[1], &data[3]) != 0) {
 			lprintf(LOG_ERR, "Invalid retry: %s", argv[1]);

Places

File lanp-Fix-buffer-overflows-in-get_lan_param_select.patch of Package ipmitool.14091

Places