Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Leap:15.3
ipmitool.14091
lanp-Fix-buffer-overflows-in-get_lan_param_sele...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File lanp-Fix-buffer-overflows-in-get_lan_param_select.patch of Package ipmitool.14091
From: Chrostoper Ertl <chertl@microsoft.com> Subject: lanp: Fix buffer overflows in get_lan_param_select References: bsc#1163026, CVE-2020-5208 Patch-Mainline: Git-commit: d45572d71e70840e0d4c50bf48218492b79c1a10 Git-repo: https://github.com/ipmitool/ipmitool.git.git Partial fix for CVE-2020-5208, see https://github.com/ipmitool/ipmitool/security/advisories/GHSA-g659-9qxw-p7cp The `get_lan_param_select` function is missing a validation check on the response’s `data_len`, which it then returns to caller functions, where stack buffer overflow can occur. Signed-off-by: <trenn@suse.com> --- lib/ipmi_lanp.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) --- a/lib/ipmi_lanp.c +++ b/lib/ipmi_lanp.c @@ -1806,7 +1806,7 @@ if (!p) { return (-1); } - memcpy(data, p->data, p->data_len); + memcpy(data, p->data, __min(p->data_len, sizeof(data))); /* set new ipaddr */ memcpy(data+3, temp, 4); printf("Setting LAN Alert %d IP Address to %d.%d.%d.%d\n", alert, @@ -1821,7 +1821,7 @@ if (!p) { return (-1); } - memcpy(data, p->data, p->data_len); + memcpy(data, p->data, __min(p->data_len, sizeof(data))); /* set new macaddr */ memcpy(data+7, temp, 6); printf("Setting LAN Alert %d MAC Address to " @@ -1835,7 +1835,7 @@ if (!p) { return (-1); } - memcpy(data, p->data, p->data_len); + memcpy(data, p->data, __min(p->data_len, sizeof(data))); if (strncasecmp(argv[1], "def", 3) == 0 || strncasecmp(argv[1], "default", 7) == 0) { @@ -1861,7 +1861,7 @@ if (!p) { return (-1); } - memcpy(data, p->data, p->data_len); + memcpy(data, p->data, __min(p->data_len, sizeof(data))); if (strncasecmp(argv[1], "on", 2) == 0 || strncasecmp(argv[1], "yes", 3) == 0) { @@ -1886,7 +1886,7 @@ if (!p) { return (-1); } - memcpy(data, p->data, p->data_len); + memcpy(data, p->data, __min(p->data_len, sizeof(data))); if (strncasecmp(argv[1], "pet", 3) == 0) { printf("Setting LAN Alert %d destination to PET Trap\n", alert); @@ -1914,7 +1914,7 @@ if (!p) { return (-1); } - memcpy(data, p->data, p->data_len); + memcpy(data, p->data, __min(p->data_len, sizeof(data))); if (str2uchar(argv[1], &data[2]) != 0) { lprintf(LOG_ERR, "Invalid time: %s", argv[1]); @@ -1930,7 +1930,7 @@ if (!p) { return (-1); } - memcpy(data, p->data, p->data_len); + memcpy(data, p->data, __min(p->data_len, sizeof(data))); if (str2uchar(argv[1], &data[3]) != 0) { lprintf(LOG_ERR, "Invalid retry: %s", argv[1]);
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor