mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-19 16:40:46 -09:00
3a5af1b3c0
Thanks to the OpenEmbedded community for the patches. This fixes the
following vulnerability:
- CVE-2026-29004:
BusyBox before commit 42202bf contains a heap buffer overflow
vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option
handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent
attackers to trigger memory corruption by sending a crafted DHCPv6
response with a malformed D6_OPT_DNS_SERVERS option. Attackers can
exploit incorrect heap buffer allocation calculations in the
option_to_env() function to cause denial of service or achieve
arbitrary code execution on embedded systems without heap hardening.
https://www.cve.org/CVERecord?id=CVE-2026-29004
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
(alternative to commit 5a27004cff)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
46 lines
1.7 KiB
Diff
46 lines
1.7 KiB
Diff
From 1e14c5c577a7bd46f42315e9bc445419770041a7 Mon Sep 17 00:00:00 2001
|
|
From: Denys Vlasenko <vda.linux@googlemail.com>
|
|
Date: Thu, 12 Mar 2026 13:23:48 +0100
|
|
Subject: [PATCH] udhcpc6: check the size of D6_OPT_IAPREFIX option
|
|
|
|
function old new delta
|
|
option_to_env 694 711 +17
|
|
|
|
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
|
|
|
|
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
|
|
Upstream: https://github.com/vda-linux/busybox_mirror/commit/d368f3f7836d1c2484c8f839316e5c93e76d4409
|
|
CVE: CVE-2026-29004
|
|
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
|
|
---
|
|
networking/udhcp/d6_dhcpc.c | 7 +++++--
|
|
1 file changed, 5 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/networking/udhcp/d6_dhcpc.c b/networking/udhcp/d6_dhcpc.c
|
|
index d13b05829..1851cee2a 100644
|
|
--- a/networking/udhcp/d6_dhcpc.c
|
|
+++ b/networking/udhcp/d6_dhcpc.c
|
|
@@ -287,8 +287,8 @@ static void option_to_env(const uint8_t *option, const uint8_t *option_end)
|
|
* | valid-lifetime |
|
|
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
*/
|
|
- /* Make sure payload contains an address */
|
|
- if (option[3] < 24)
|
|
+ /* Make sure payload exists */
|
|
+ if (option[3] < (16 + 4 + 4))
|
|
break;
|
|
|
|
sprint_nip6(ipv6str, option + 4);
|
|
@@ -332,6 +332,9 @@ static void option_to_env(const uint8_t *option, const uint8_t *option_end)
|
|
* | |
|
|
* +-+-+-+-+-+-+-+-+
|
|
*/
|
|
+ /* Make sure payload exists */
|
|
+ if (option[3] < (4 + 4 + 1 + 16))
|
|
+ break;
|
|
move_from_unaligned32(v32, option + 4 + 4);
|
|
v32 = ntohl(v32);
|
|
*new_env() = xasprintf("ipv6prefix_lease=%u", (unsigned)v32);
|
|
--
|
|
2.34.1
|