dhcp6: Make sure we have enough space for the DHCP6 option header

Fixes out-of-bounds heap write in systemd-networkd dhcpv6 option
handling which also affects the "internal" DHCP plugin of
NetworkManager.

CVE-2018-15688
LP: #1795921

1 files changed, 25 insertions, 0 deletions

diff --git a/debian/patches/dhcp6-fix-buffer-size-checking.patch b/debian/patches/dhcp6-fix-buffer-size-checking.patch
new file mode 100644
index 00000000..921573b8
--- /dev/null
+++ b/debian/patches/dhcp6-fix-buffer-size-checking.patch
@@ -0,0 +1,25 @@
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Thu, 27 Sep 2018 23:48:51 +0900
+Subject: dhcp6: fix buffer size checking
+
+(cherry picked from commit cb1bdeaf56852275e6b0dd1fba932bb174767f70)
+(cherry picked from commit 91fb1673d5217aaf1461998fd2675630f5c265f9)
+---
+ src/systemd/src/libsystemd-network/sd-dhcp6-client.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/systemd/src/libsystemd-network/sd-dhcp6-client.c b/src/systemd/src/libsystemd-network/sd-dhcp6-client.c
+index 8444a75..0b261a2 100644
+--- a/src/systemd/src/libsystemd-network/sd-dhcp6-client.c
++++ b/src/systemd/src/libsystemd-network/sd-dhcp6-client.c
+@@ -818,8 +818,8 @@ static int client_parse_message(
+                 uint8_t *optval;
+                 be32_t iaid_lease;
+ 
+-                if (len < offsetof(DHCP6Option, data) ||
+-                    len < offsetof(DHCP6Option, data) + be16toh(option->len))
++                if (len < pos + offsetof(DHCP6Option, data) ||
++                    len < pos + offsetof(DHCP6Option, data) + be16toh(option->len))
+                         return -ENOBUFS;
+ 
+                 optcode = be16toh(option->code);