mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-09 17:03:35 -09:00
Compare commits
4 Commits
39d8525ede
...
94a817a589
| Author | SHA1 | Date | |
|---|---|---|---|
|
94a817a589 | ||
|
|
d6ce4e2602 | ||
|
|
8090d0eb9e | ||
|
|
766a6e5c0b |
@@ -1,5 +1,5 @@
|
||||
# Locally computed
|
||||
sha256 8a94650b6f348af1f1c9cce7ed3585d280f3a31b0d3820084a42b03712df95d5 asterisk-22.5.2.tar.gz
|
||||
sha256 4f30af0695a0131fc091d85e7b91e22504609434b3fbd263898c7354d41959c9 asterisk-22.8.1.tar.gz
|
||||
|
||||
# Locally computed
|
||||
sha256 58bb83cec4d431f48d006e455d821668450f8cf6b6c95f090def47062fa3a60c pjproject-2.15.1.tar.bz2
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
################################################################################
|
||||
|
||||
ASTERISK_VERSION = 22.5.2
|
||||
ASTERISK_VERSION = 22.8.1
|
||||
# Use the github mirror: it's an official mirror maintained by Digium, and
|
||||
# provides tarballs, which the main Asterisk git tree (behind Gerrit) does not.
|
||||
ASTERISK_SITE = $(call github,asterisk,asterisk,$(ASTERISK_VERSION))
|
||||
|
||||
@@ -1,46 +0,0 @@
|
||||
From dda24815d148b91209ebf2d27e3a7acefe9b6435 Mon Sep 17 00:00:00 2001
|
||||
From: Tobias Brunner <tobias@strongswan.org>
|
||||
Date: Thu, 9 Oct 2025 11:33:45 +0200
|
||||
Subject: [PATCH] eap-mschapv2: Fix length check for Failure Request packets on
|
||||
the client
|
||||
|
||||
For message lengths between 6 and 8, subtracting HEADER_LEN (9) causes
|
||||
`message_len` to become negative, which is then used in calls to malloc()
|
||||
and memcpy() that both take size_t arguments, causing an integer
|
||||
underflow.
|
||||
|
||||
For 6 and 7, the huge size requested from malloc() will fail (it exceeds
|
||||
PTRDIFF_MAX) and the returned NULL pointer will cause a segmentation
|
||||
fault in memcpy().
|
||||
|
||||
However, for 8, the allocation is 0, which succeeds. But then the -1
|
||||
passed to memcpy() causes a heap-based buffer overflow (and possibly a
|
||||
segmentation fault when attempting to read/write that much data).
|
||||
Fortunately, if compiled with -D_FORTIFY_SOURCE=3 (the default on e.g.
|
||||
Ubuntu), the compiler will use __memcpy_chk(), which prevents that buffer
|
||||
overflow and causes the daemon to get aborted immediately instead.
|
||||
|
||||
Fixes: f98cdf7a4765 ("adding plugin for EAP-MS-CHAPv2")
|
||||
Fixes: CVE-2025-62291
|
||||
Upstream: https://github.com/strongswan/strongswan/commit/c687ada6a6f68913651e355fd09f906893096b32
|
||||
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
|
||||
---
|
||||
src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c b/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c
|
||||
index 21cc95a6a360..35faad2e0bb5 100644
|
||||
--- a/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c
|
||||
+++ b/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c
|
||||
@@ -974,7 +974,7 @@ static status_t process_peer_failure(private_eap_mschapv2_t *this,
|
||||
data = in->get_data(in);
|
||||
eap = (eap_mschapv2_header_t*)data.ptr;
|
||||
|
||||
- if (data.len < 3) /* we want at least an error code: E=e */
|
||||
+ if (data.len < HEADER_LEN + 3) /* we want at least an error code: E=e */
|
||||
{
|
||||
DBG1(DBG_IKE, "received invalid EAP-MS-CHAPv2 message: too short");
|
||||
return FAILED;
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# From http://download.strongswan.org/strongswan-5.9.14.tar.bz2.md5
|
||||
md5 21ca3fc7c18456405d03b77266ba630a strongswan-5.9.14.tar.bz2
|
||||
# From http://download.strongswan.org/strongswan-6.0.4.tar.bz2.md5
|
||||
md5 f6b78a99e95179b6a65df218d75da7ca strongswan-6.0.4.tar.bz2
|
||||
# Calculated based on the hash above
|
||||
sha256 728027ddda4cb34c67c4cec97d3ddb8c274edfbabdaeecf7e74693b54fc33678 strongswan-5.9.14.tar.bz2
|
||||
sha256 79576bb61b9a406cea9eb73d0c565cc6254a6b6d2e7198f44758d2d7c61a7aec strongswan-6.0.4.tar.bz2
|
||||
# Locally calculated
|
||||
sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING
|
||||
sha256 2292e21797754548dccdef9eef6aee7584e552fbd890fa914e1de8d3577d23f0 LICENSE
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
################################################################################
|
||||
|
||||
STRONGSWAN_VERSION = 5.9.14
|
||||
STRONGSWAN_VERSION = 6.0.4
|
||||
STRONGSWAN_SOURCE = strongswan-$(STRONGSWAN_VERSION).tar.bz2
|
||||
STRONGSWAN_SITE = http://download.strongswan.org
|
||||
STRONGSWAN_LICENSE = GPL-2.0+
|
||||
@@ -12,8 +12,6 @@ STRONGSWAN_LICENSE_FILES = COPYING LICENSE
|
||||
STRONGSWAN_CPE_ID_VENDOR = strongswan
|
||||
STRONGSWAN_DEPENDENCIES = host-pkgconf
|
||||
STRONGSWAN_INSTALL_STAGING = YES
|
||||
# 0001-eap_mschapv2_failure_request_len.patch
|
||||
STRONGSWAN_IGNORE_CVES += CVE-2025-62291
|
||||
STRONGSWAN_CONF_OPTS += \
|
||||
--without-lib-prefix \
|
||||
--enable-led \
|
||||
@@ -114,4 +112,16 @@ STRONGSWAN_CONF_OPTS += \
|
||||
--disable-connmark \
|
||||
--disable-forecast
|
||||
|
||||
# bare minimum to start charon
|
||||
define STRONGSWAN_LINUX_CONFIG_FIXUPS
|
||||
$(call KCONFIG_ENABLE_OPT,CONFIG_INET)
|
||||
$(call KCONFIG_ENABLE_OPT,CONFIG_NET)
|
||||
$(call KCONFIG_ENABLE_OPT,CONFIG_NETLINK)
|
||||
$(call KCONFIG_ENABLE_OPT,CONFIG_INET_AH)
|
||||
$(call KCONFIG_ENABLE_OPT,CONFIG_INET_ESP)
|
||||
$(call KCONFIG_ENABLE_OPT,CONFIG_XFRM)
|
||||
$(call KCONFIG_ENABLE_OPT,CONFIG_XFRM_USER)
|
||||
$(call KCONFIG_ENABLE_OPT,CONFIG_XFRM_INTERFACE)
|
||||
endef
|
||||
|
||||
$(eval $(autotools-package))
|
||||
|
||||
Reference in New Issue
Block a user