已开启
fix CVE-2025-62291 #98
Funda Wang创建于 2025年11月8日
fix CVE-2025-62291 #98
已开启
从refs/pull/98/head合入到openEuler-22.03-LTS-SP4
共 2 个文件变更+54-5
| @@ -0,0 +1,44 @@ | |||
| 1 | +From dda24815d148b91209ebf2d27e3a7acefe9b6435 Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Tobias Brunner <tobias@strongswan.org> | ||
| 3 | +Date: Thu, 9 Oct 2025 11:33:45 +0200 | ||
| 4 | +Subject: [PATCH] eap-mschapv2: Fix length check for Failure Request packets on | ||
| 5 | + the client | ||
| 6 | + | ||
| 7 | +For message lengths between 6 and 8, subtracting HEADER_LEN (9) causes | ||
| 8 | +`message_len` to become negative, which is then used in calls to malloc() | ||
| 9 | +and memcpy() that both take size_t arguments, causing an integer | ||
| 10 | +underflow. | ||
| 11 | + | ||
| 12 | +For 6 and 7, the huge size requested from malloc() will fail (it exceeds | ||
| 13 | +PTRDIFF_MAX) and the returned NULL pointer will cause a segmentation | ||
| 14 | +fault in memcpy(). | ||
| 15 | + | ||
| 16 | +However, for 8, the allocation is 0, which succeeds. But then the -1 | ||
| 17 | +passed to memcpy() causes a heap-based buffer overflow (and possibly a | ||
| 18 | +segmentation fault when attempting to read/write that much data). | ||
| 19 | +Fortunately, if compiled with -D_FORTIFY_SOURCE=3 (the default on e.g. | ||
| 20 | +Ubuntu), the compiler will use __memcpy_chk(), which prevents that buffer | ||
| 21 | +overflow and causes the daemon to get aborted immediately instead. | ||
| 22 | + | ||
| 23 | +Fixes: f98cdf7a4765 ("adding plugin for EAP-MS-CHAPv2") | ||
| 24 | +Fixes: CVE-2025-62291 | ||
| 25 | +--- | ||
| 26 | + src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c | 2 +- | ||
| 27 | + 1 file changed, 1 insertion(+), 1 deletion(-) | ||
| 28 | + | ||
| 29 | +diff --git a/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c b/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c | ||
| 30 | +index 21cc95a6a360..35faad2e0bb5 100644 | ||
| 31 | +--- a/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c | ||
| 32 | ++++ b/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c | ||
| 33 | +@@ -974,7 +974,7 @@ static status_t process_peer_failure(private_eap_mschapv2_t *this, | ||
| 34 | + data = in->get_data(in); | ||
| 35 | + eap = (eap_mschapv2_header_t*)data.ptr; | ||
| 36 | + | ||
| 37 | +- if (data.len < 3) /* we want at least an error code: E=e */ | ||
| 38 | ++ if (data.len < HEADER_LEN + 3) /* we want at least an error code: E=e */ | ||
| 39 | + { | ||
| 40 | + DBG1(DBG_IKE, "received invalid EAP-MS-CHAPv2 message: too short"); | ||
| 41 | + return FAILED; | ||
| 42 | +-- | ||
| 43 | +2.43.0 | ||
| 44 | + | ||
| @@ -1,15 +1,17 @@ | |||
| 1 | Name: strongswan | 1 | Name: strongswan |
| 2 | Version: 5.9.7 | 2 | Version: 5.9.7 |
| 3 | -Release: 5 | 3 | +Release: 6 |
| 4 | Summary: An OpenSource IPsec-based VPN and TNC solution | 4 | Summary: An OpenSource IPsec-based VPN and TNC solution |
| 5 | -License: GPLv2+ | 5 | +License: GPL-2.0-or-later |
| 6 | -URL: http://www.strongswan.org/ | 6 | +URL: https://www.strongswan.org/ |
| 7 | -Source0: http://download.strongswan.org/strongswan-%{version}.tar.bz2 | 7 | +Source0: https://download.strongswan.org/old/5.x/strongswan-%{version}.tar.bz2 |
| 8 | 8 | ||
| 9 | Patch0: remove-warning-no-format.patch | 9 | Patch0: remove-warning-no-format.patch |
| 10 | Patch1: CVE-2022-40617.patch | 10 | Patch1: CVE-2022-40617.patch |
| 11 | # https://download.strongswan.org/security/CVE-2023-41913/strongswan-5.9.7-5.9.11_charon_tkm_dh_len.patch | 11 | # https://download.strongswan.org/security/CVE-2023-41913/strongswan-5.9.7-5.9.11_charon_tkm_dh_len.patch |
| 12 | Patch2: CVE-2023-41913.patch | 12 | Patch2: CVE-2023-41913.patch |
| 13 | +# https://download.strongswan.org/security/CVE-2025-62291/strongswan-4.4.0-6.0.2_eap_mschapv2_failure_request_len.patch | ||
| 14 | +Patch3: strongswan-4.4.0-6.0.2_eap_mschapv2_failure_request_len.patch | ||
| 13 | 15 | ||
| 14 | BuildRequires: gcc chrpath autoconf automake libtool tpm2-abrmd | 16 | BuildRequires: gcc chrpath autoconf automake libtool tpm2-abrmd |
| 15 | BuildRequires: systemd-devel gmp-devel libcurl-devel NetworkManager-libnm-devel openldap-devel | 17 | BuildRequires: systemd-devel gmp-devel libcurl-devel NetworkManager-libnm-devel openldap-devel |
| @@ -190,11 +192,14 @@ echo "%{_libdir}/strongswan" > %{buildroot}/etc/ld.so.conf.d/%{name}-%{_arch}.co | |||
| 190 | %{_libdir}/strongswan/plugins/libstrongswan-kernel-libipsec.so | 192 | %{_libdir}/strongswan/plugins/libstrongswan-kernel-libipsec.so |
| 191 | 193 | ||
| 192 | %files charon-nm | 194 | %files charon-nm |
| 193 | -%doc COPYING | 195 | +%license COPYING |
| 194 | %{_sysconfdir}/dbus-1/system.d/nm-strongswan-service.conf | 196 | %{_sysconfdir}/dbus-1/system.d/nm-strongswan-service.conf |
| 195 | %{_libexecdir}/strongswan/charon-nm | 197 | %{_libexecdir}/strongswan/charon-nm |
| 196 | 198 | ||
| 197 | %changelog | 199 | %changelog |
| 200 | +* Sat Nov 08 2025 Funda Wang <fundawang@yeah.net> - 5.9.7-6 | ||
| 201 | +- fix CVE-2025-62291 | ||
| 202 | + | ||
| 198 | * Thu Dec 14 2023 yaoxin <yao_xin001@hoperun.com> - 5.9.7-5 | 203 | * Thu Dec 14 2023 yaoxin <yao_xin001@hoperun.com> - 5.9.7-5 |
| 199 | - Fix CVE-2023-41913 | 204 | - Fix CVE-2023-41913 |
| 200 | 205 | ||