149 lines
5.9 KiB
Text
149 lines
5.9 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-20:27.ure Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: ure device driver susceptible to packet-in-packet attack
|
|
|
|
Category: core
|
|
Module: ure
|
|
Announced: 2020-09-15
|
|
Credits: John-Mark Gurney
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2020-09-14 19:39:43 UTC (stable/12, 12.2-STABLE)
|
|
2020-09-15 21:42:05 UTC (releng/12.2, 12.2-BETA1-p1)
|
|
2020-09-15 21:42:05 UTC (releng/12.1, 12.1-RELEASE-p10)
|
|
2020-09-15 00:22:30 UTC (stable/11, 11.4-STABLE)
|
|
2020-09-15 21:42:05 UTC (releng/11.4, 11.4-RELEASE-p4)
|
|
2020-09-15 21:42:05 UTC (releng/11.3, 11.3-RELEASE-p14)
|
|
CVE Name: CVE-2020-7464
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
The ure(4) driver provides support for USB Ethernet adapters based on the
|
|
Realtek RTL8152 and RTL8153 USB Ethernet controllers.
|
|
|
|
II. Problem Description
|
|
|
|
A programming error in the ure(4) device driver caused some Realtek USB
|
|
Ethernet interfaces to incorrectly report packets with more than 2048 bytes
|
|
in a single USB transfer as having a length of only 2048 bytes.
|
|
|
|
An adversary can exploit this to cause the driver to misinterpret part of the
|
|
payload of a large packet as a separate packet, and thereby inject packets
|
|
across security boundaries such as VLANs.
|
|
|
|
III. Impact
|
|
|
|
An attacker that can send large frames (larger than 2048 bytes in size) to be
|
|
received by the host (be it VLAN, or non-VLAN tagged packet), can inject
|
|
arbitrary packets to be received and processed by the host. This includes
|
|
spoofing packets from other hosts, or injecting packets to other VLANs than
|
|
the host is on.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available. However, an attacker needs to be able to inject
|
|
large frames. If a switch can prevent large frames (>2048 bytes) from being
|
|
received, or connecting the machine to a switch that does not forward large
|
|
frames will mitigate this attack.
|
|
|
|
V. Solution
|
|
|
|
Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date,
|
|
and reboot.
|
|
|
|
Perform one of the following:
|
|
|
|
1) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
# shutdown -r +10min "Rebooting for a security update"
|
|
|
|
2) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
[FreeBSD 12.1, FreeBSD 12.2]
|
|
# fetch https://security.FreeBSD.org/patches/SA-20:27/ure.12.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-20:27/ure.12.patch.asc
|
|
# gpg --verify ure.12.patch.asc
|
|
|
|
[FreeBSD 11.3, FreeBSD 11.4]
|
|
# fetch https://security.FreeBSD.org/patches/SA-20:27/ure.11.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-20:27/ure.11.patch.asc
|
|
# gpg --verify ure.11.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile your kernel as described in
|
|
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
|
|
system.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/12/ r365730
|
|
releng/12.2/ r365778
|
|
releng/12.1/ r365778
|
|
stable/11/ r365738
|
|
releng/11.4/ r365778
|
|
releng/11.3/ r365778
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7464>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-20:27.ure.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
|
|
iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl9hOIxfFIAAAAAALgAo
|
|
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
|
|
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
|
|
5cJY9A//Z+Rt20iUnM79er+CYF4EQNrzR8dOKr2/6L5ho5L1kJt0MdZtamN+f5Bq
|
|
Jpzem060oAv+0mgAiK3VR7unlkEk+wFNvMwhgItvI8l2TME3+n/A0nsYQkP9QPPp
|
|
SwHmKcIAbwkdtv913zy7AGc/vE+2+D8x84WHp6WDhRmDVgU5QAPGgP4yv0qhgkpy
|
|
L8ndLDte3tXMk0eWArxWTpMfxqKGmp9Cgy88QRoIpguazS+ocSVt6h3emxQPtTc/
|
|
7SQOEqjg4IiEXW/t2SSDqB1cvNPmN82yJt4mQg1m8v/SjFjFQ2qgFC+47cYezI1F
|
|
nLuoDw16kYUu65DyePiXfCsBwSjkLU1IgpBSgmmxjMzwoVgE7/9AtRqiCwe2xkEF
|
|
E6c1VWAQAw2AiZmsISv8T9RNLegLnNjyhO9iSsaeuOfLbTIeQ9zbcUL6xgZB6AxO
|
|
tk/fkt+NHwuRoXNx2SC959r+hwhdnrpgxTEphjCFuuMdMGKsxm3TQGdwD6ZvQ1r2
|
|
HkVV1m4ukgpxw8ONa88Lgo+2f1HZhZKWLzp3EsTA3LMpgk+5uJjIuL/ctuddscWY
|
|
Do9VapPTIGxjZqABGtxJL7NrzCz2pXE0CHzAjFWD830kujgcdihe6FbJx0cJe3m8
|
|
+CxaGBXvSINHyPwgDArnKR3Hrd57/T6RSUWqsksB7fBCpmFdQaI=
|
|
=S9sW
|
|
-----END PGP SIGNATURE-----
|