156 lines
6.5 KiB
Text
156 lines
6.5 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-20:32.rtsold Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: Multiple vulnerabilities in rtsold
|
|
|
|
Category: core
|
|
Module: rtsold
|
|
Announced: 2020-12-01
|
|
Credits: Quarkslab Vulnerability Reports
|
|
Affects: All supported versions of FreeBSD
|
|
Corrected: 2020-12-01 19:35:48 UTC (stable/12, 12.2-STABLE)
|
|
2020-12-01 19:39:44 UTC (releng/12.2, 12.2-RELEASE-p1)
|
|
2020-12-01 19:39:44 UTC (releng/12.1, 12.1-RELEASE-p11)
|
|
2020-12-01 19:36:37 UTC (stable/11, 11.4-STABLE)
|
|
2020-12-01 19:39:44 UTC (releng/11.4, 11.4-RELEASE-p5)
|
|
CVE Name: CVE-2020-25577
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
As part of the stateless address autoconfiguration (SLAAC) mechanism, IPv6
|
|
routers periodically broadcast router advertisement messages on attached
|
|
networks to inform hosts of the correct network prefix, router address and
|
|
MTU, as well as additional network parameters such as the DNS servers
|
|
(RDNSS), DNS search list (DNSSL) and whether a stateful configuration service
|
|
is available. Hosts that have recently joined the network can broadcast a
|
|
router solicitation message to solicit an immediate advertisement instead of
|
|
waiting for the next periodic advertisement.
|
|
|
|
The router solicitation daemon, rtsold(8), broadcasts router solicitation
|
|
messages at startup or when the state of an interface changes from passive to
|
|
active. Incoming router advertisement messages are first processed by the
|
|
kernel and then passed on to rtsold(8), which handles the DNS and stateful
|
|
configuration options.
|
|
|
|
II. Problem Description
|
|
|
|
Two bugs exist in rtsold(8)'s RDNSS and DNSSL option handling. First,
|
|
rtsold(8) failed to perform sufficient bounds checking on the extent of the
|
|
option. In particular, it does not verify that the option does not extend
|
|
past the end of the received packet before processing its contents. The
|
|
kernel currently ignores such malformed packets but still passes them to
|
|
userspace programs.
|
|
|
|
Second, when processing a DNSSL option, rtsold(8) decodes domain name labels
|
|
per an encoding specified in RFC 1035 in which the first octet of each label
|
|
contains the label's length. rtsold(8) did not validate label lengths
|
|
correctly and could overflow the destination buffer.
|
|
|
|
III. Impact
|
|
|
|
It is believed that these bugs could be exploited to gain remote code
|
|
execution within the rtsold(8) daemon, which runs as root. Note that
|
|
rtsold(8) only processes messages received from hosts attached to the same
|
|
physical link as the interface(s) on which rtsold(8) is listening.
|
|
|
|
In FreeBSD 12.2 rtsold(8) runs in a Capsicum sandbox, limiting the scope of a
|
|
compromised rtsold(8) process.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available, but systems that do not run rtsold(8) are not
|
|
affected.
|
|
|
|
V. Solution
|
|
|
|
Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
Perform one of the following:
|
|
|
|
1) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
2) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch https://security.FreeBSD.org/patches/SA-20:32/rtsold.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-20:32/rtsold.patch.asc
|
|
# gpg --verify rtsold.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile the operating system using buildworld and installworld as
|
|
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
|
|
|
|
Restart the applicable daemons, or reboot the system.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/12/ r368250
|
|
releng/12.2/ r368256
|
|
releng/12.1/ r368256
|
|
stable/11/ r368253
|
|
releng/11.4/ r368256
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25577>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-20:32.rtsold.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
|
|
iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl/GndZfFIAAAAAALgAo
|
|
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
|
|
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
|
|
5cIUXQ/+K/FAB22beBBiOUDaRMF0n4a/umwvwX2BAy7PsLIzRcYL8ydhvTWPXQnU
|
|
KssmRoi0eobczpIYgIqTDNDTI46UErEvfoCBTIiY+uedER77FKxesfnO/9S3owvh
|
|
8uP+WCMzZXRfNvIYqEsK43ipm3LL4rDfUNLEdeFj0bLlwEwiTJaXsdLayJ3KpanN
|
|
A3ykePDXnQD41BcDcotvzSV6r7o5dbCILI4K4zEOSCAXBP1Du16J/K/aHOWahJ20
|
|
Ex6YFg0llH3VkAVE9iGdHLGFqakjobUhm+LzV9ShAkXZqZs3Hx+p8dfM4w7aicCM
|
|
f6Nn0rLlb4ZdSmMnbsexoZZwO0v2dQNHd1EEtQD6zjJfey1auJKJLTcLoWXH+3mm
|
|
w5eOjjmqdOkab0h224q8jidhgyUm1c8By5H5aZ79y5SpRG0mfuS82Z6uIAf0KKZ3
|
|
uIzPswc0YtI30M638ZCKCug3gxwZu4EG7P08/Ab4B0fpyfqqLy6KVsMdH6w64R6+
|
|
64twgiVPuM3DpokvTfdcQLp13IHeMJwkpdc/SICyg3NDAFJZMcIe6eqjko5FsNnH
|
|
RSjA0SHRKyl303OLR+jUHe64m+LISyNne+fC1VoThbqQ1f5nWX9PlF4VjRu30Wz4
|
|
8VcmRCehMT1G1aIEGG74zKDeWDP6+bGeieBU7Pa/jfr/aI88Hw0=
|
|
=5tIC
|
|
-----END PGP SIGNATURE-----
|