mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-30 14:01:57 -09:00
7172f0642c
Fixes the following vulnerability:
- CVE-2025-54349
In iperf before 3.19.1, iperf_auth.c has an off-by-one error and
resultant heap-based buffer overflow.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-54349
- 4e5313bab0
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
94 lines
3.4 KiB
Diff
94 lines
3.4 KiB
Diff
From 4e5313bab0b9b3fe03513ab54f722c8a3e4b7bdf Mon Sep 17 00:00:00 2001
|
|
From: Sarah Larsen <swlarsen@es.net>
|
|
Date: Wed, 25 Jun 2025 15:11:03 +0000
|
|
Subject: [PATCH] Fix off-by-one heap overflow in auth.
|
|
|
|
Reported by Han Lee (Apple Information Security)
|
|
|
|
CVE: CVE-2025-54349
|
|
Upstream: https://github.com/esnet/iperf/commit/4e5313bab0b9b3fe03513ab54f722c8a3e4b7bdf
|
|
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
|
|
---
|
|
src/iperf_auth.c | 18 +++++++++++++-----
|
|
1 file changed, 13 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/src/iperf_auth.c b/src/iperf_auth.c
|
|
index b9f2bc0f2..632f03d24 100644
|
|
--- a/src/iperf_auth.c
|
|
+++ b/src/iperf_auth.c
|
|
@@ -288,6 +288,7 @@ int encrypt_rsa_message(const char *plaintext, EVP_PKEY *public_key, unsigned ch
|
|
}
|
|
|
|
int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedtext_len, EVP_PKEY *private_key, unsigned char **plaintext, int use_pkcs1_padding) {
|
|
+ int ret =0;
|
|
#if OPENSSL_VERSION_MAJOR >= 3
|
|
EVP_PKEY_CTX *ctx;
|
|
#else
|
|
@@ -310,7 +311,8 @@ int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedt
|
|
keysize = RSA_size(rsa);
|
|
#endif
|
|
rsa_buffer = OPENSSL_malloc(keysize * 2);
|
|
- *plaintext = (unsigned char*)OPENSSL_malloc(keysize);
|
|
+ // Note: +1 for NULL
|
|
+ *plaintext = (unsigned char*)OPENSSL_malloc(keysize + 1);
|
|
|
|
BIO *bioBuff = BIO_new_mem_buf((void*)encryptedtext, encryptedtext_len);
|
|
rsa_buffer_len = BIO_read(bioBuff, rsa_buffer, keysize * 2);
|
|
@@ -320,13 +322,15 @@ int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedt
|
|
padding = RSA_PKCS1_PADDING;
|
|
}
|
|
#if OPENSSL_VERSION_MAJOR >= 3
|
|
+
|
|
plaintext_len = keysize;
|
|
EVP_PKEY_decrypt_init(ctx);
|
|
- int ret = EVP_PKEY_CTX_set_rsa_padding(ctx, padding);
|
|
+
|
|
+ ret = EVP_PKEY_CTX_set_rsa_padding(ctx, padding);
|
|
if (ret < 0){
|
|
goto errreturn;
|
|
}
|
|
- EVP_PKEY_decrypt(ctx, *plaintext, &plaintext_len, rsa_buffer, rsa_buffer_len);
|
|
+ ret = EVP_PKEY_decrypt(ctx, *plaintext, &plaintext_len, rsa_buffer, rsa_buffer_len);
|
|
EVP_PKEY_CTX_free(ctx);
|
|
#else
|
|
plaintext_len = RSA_private_decrypt(rsa_buffer_len, rsa_buffer, *plaintext, rsa, padding);
|
|
@@ -337,7 +341,7 @@ int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedt
|
|
BIO_free(bioBuff);
|
|
|
|
/* Treat a decryption error as an empty string. */
|
|
- if (plaintext_len < 0) {
|
|
+ if (plaintext_len <= 0) {
|
|
plaintext_len = 0;
|
|
}
|
|
|
|
@@ -386,24 +390,28 @@ int decode_auth_setting(int enable_debug, const char *authtoken, EVP_PKEY *priva
|
|
int plaintext_len;
|
|
plaintext_len = decrypt_rsa_message(encrypted_b64, encrypted_len_b64, private_key, &plaintext, use_pkcs1_padding);
|
|
free(encrypted_b64);
|
|
- if (plaintext_len < 0) {
|
|
+ if (plaintext_len <= 0) {
|
|
return -1;
|
|
}
|
|
+
|
|
plaintext[plaintext_len] = '\0';
|
|
|
|
char *s_username, *s_password;
|
|
s_username = (char *) calloc(plaintext_len, sizeof(char));
|
|
if (s_username == NULL) {
|
|
+ OPENSSL_free(plaintext);
|
|
return -1;
|
|
}
|
|
s_password = (char *) calloc(plaintext_len, sizeof(char));
|
|
if (s_password == NULL) {
|
|
+ OPENSSL_free(plaintext);
|
|
free(s_username);
|
|
return -1;
|
|
}
|
|
|
|
int rc = sscanf((char *) plaintext, auth_text_format, s_username, s_password, &utc_seconds);
|
|
if (rc != 3) {
|
|
+ OPENSSL_free(plaintext);
|
|
free(s_password);
|
|
free(s_username);
|
|
return -1;
|