| b.liu | e958203 | 2025-04-17 19:18:16 +0800 | [diff] [blame^] | 1 | From 960dbb956d9f9cb05b719087faed53c88dc80956 Mon Sep 17 00:00:00 2001 |
| 2 | From: Chrostoper Ertl <chertl@microsoft.com> |
| 3 | Date: Thu, 28 Nov 2019 16:33:59 +0000 |
| 4 | Subject: [PATCH 06/11] fru: Fix buffer overflow vulnerabilities |
| 5 | |
| 6 | Partial fix for CVE-2020-5208, see |
| 7 | https://github.com/ipmitool/ipmitool/security/advisories/GHSA-g659-9qxw-p7cp |
| 8 | |
| 9 | The `read_fru_area_section` function only performs size validation of |
| 10 | requested read size, and falsely assumes that the IPMI message will not |
| 11 | respond with more than the requested amount of data; it uses the |
| 12 | unvalidated response size to copy into `frubuf`. If the response is |
| 13 | larger than the request, this can result in overflowing the buffer. |
| 14 | |
| 15 | The same issue affects the `read_fru_area` function. |
| 16 | --- |
| 17 | lib/ipmi_fru.c | 33 +++++++++++++++++++++++++++++++-- |
| 18 | 1 file changed, 31 insertions(+), 2 deletions(-) |
| 19 | |
| 20 | --- a/lib/ipmi_fru.c |
| 21 | +++ b/lib/ipmi_fru.c |
| 22 | @@ -615,7 +615,10 @@ int |
| 23 | read_fru_area(struct ipmi_intf * intf, struct fru_info *fru, uint8_t id, |
| 24 | uint32_t offset, uint32_t length, uint8_t *frubuf) |
| 25 | { |
| 26 | - uint32_t off = offset, tmp, finish; |
| 27 | + uint32_t off = offset; |
| 28 | + uint32_t tmp; |
| 29 | + uint32_t finish; |
| 30 | + uint32_t size_left_in_buffer; |
| 31 | struct ipmi_rs * rsp; |
| 32 | struct ipmi_rq req; |
| 33 | uint8_t msg_data[4]; |
| 34 | @@ -628,10 +631,12 @@ read_fru_area(struct ipmi_intf * intf, s |
| 35 | |
| 36 | finish = offset + length; |
| 37 | if (finish > fru->size) { |
| 38 | + memset(frubuf + fru->size, 0, length - fru->size); |
| 39 | finish = fru->size; |
| 40 | lprintf(LOG_NOTICE, "Read FRU Area length %d too large, " |
| 41 | "Adjusting to %d", |
| 42 | offset + length, finish - offset); |
| 43 | + length = finish - offset; |
| 44 | } |
| 45 | |
| 46 | memset(&req, 0, sizeof(req)); |
| 47 | @@ -667,6 +672,7 @@ read_fru_area(struct ipmi_intf * intf, s |
| 48 | } |
| 49 | } |
| 50 | |
| 51 | + size_left_in_buffer = length; |
| 52 | do { |
| 53 | tmp = fru->access ? off >> 1 : off; |
| 54 | msg_data[0] = id; |
| 55 | @@ -707,9 +713,18 @@ read_fru_area(struct ipmi_intf * intf, s |
| 56 | } |
| 57 | |
| 58 | tmp = fru->access ? rsp->data[0] << 1 : rsp->data[0]; |
| 59 | + if(rsp->data_len < 1 |
| 60 | + || tmp > rsp->data_len - 1 |
| 61 | + || tmp > size_left_in_buffer) |
| 62 | + { |
| 63 | + printf(" Not enough buffer size"); |
| 64 | + return -1; |
| 65 | + } |
| 66 | + |
| 67 | memcpy(frubuf, rsp->data + 1, tmp); |
| 68 | off += tmp; |
| 69 | frubuf += tmp; |
| 70 | + size_left_in_buffer -= tmp; |
| 71 | /* sometimes the size returned in the Info command |
| 72 | * is too large. return 0 so higher level function |
| 73 | * still attempts to parse what was returned */ |
| 74 | @@ -742,7 +757,9 @@ read_fru_area_section(struct ipmi_intf * |
| 75 | uint32_t offset, uint32_t length, uint8_t *frubuf) |
| 76 | { |
| 77 | static uint32_t fru_data_rqst_size = 20; |
| 78 | - uint32_t off = offset, tmp, finish; |
| 79 | + uint32_t off = offset; |
| 80 | + uint32_t tmp, finish; |
| 81 | + uint32_t size_left_in_buffer; |
| 82 | struct ipmi_rs * rsp; |
| 83 | struct ipmi_rq req; |
| 84 | uint8_t msg_data[4]; |
| 85 | @@ -755,10 +772,12 @@ read_fru_area_section(struct ipmi_intf * |
| 86 | |
| 87 | finish = offset + length; |
| 88 | if (finish > fru->size) { |
| 89 | + memset(frubuf + fru->size, 0, length - fru->size); |
| 90 | finish = fru->size; |
| 91 | lprintf(LOG_NOTICE, "Read FRU Area length %d too large, " |
| 92 | "Adjusting to %d", |
| 93 | offset + length, finish - offset); |
| 94 | + length = finish - offset; |
| 95 | } |
| 96 | |
| 97 | memset(&req, 0, sizeof(req)); |
| 98 | @@ -773,6 +792,8 @@ read_fru_area_section(struct ipmi_intf * |
| 99 | if (fru->access && fru_data_rqst_size > 16) |
| 100 | #endif |
| 101 | fru_data_rqst_size = 16; |
| 102 | + |
| 103 | + size_left_in_buffer = length; |
| 104 | do { |
| 105 | tmp = fru->access ? off >> 1 : off; |
| 106 | msg_data[0] = id; |
| 107 | @@ -804,8 +825,16 @@ read_fru_area_section(struct ipmi_intf * |
| 108 | } |
| 109 | |
| 110 | tmp = fru->access ? rsp->data[0] << 1 : rsp->data[0]; |
| 111 | + if(rsp->data_len < 1 |
| 112 | + || tmp > rsp->data_len - 1 |
| 113 | + || tmp > size_left_in_buffer) |
| 114 | + { |
| 115 | + printf(" Not enough buffer size"); |
| 116 | + return -1; |
| 117 | + } |
| 118 | memcpy((frubuf + off)-offset, rsp->data + 1, tmp); |
| 119 | off += tmp; |
| 120 | + size_left_in_buffer -= tmp; |
| 121 | |
| 122 | /* sometimes the size returned in the Info command |
| 123 | * is too large. return 0 so higher level function |