From 7a9494039d2d8e263f417f7e908e4cefcde5aaf5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Fri, 21 Feb 2020 17:39:51 +0100 Subject: [PATCH] Fixed buffer overflow in the eap_request and eap_response functions Resolves: CVE-2020-8597 --- ppp-2.4.7-CVE-2020-8597.patch | 37 +++++++++++++++++++++++++++++++++++ ppp.spec | 7 ++++++- 2 files changed, 43 insertions(+), 1 deletion(-) create mode 100644 ppp-2.4.7-CVE-2020-8597.patch diff --git a/ppp-2.4.7-CVE-2020-8597.patch b/ppp-2.4.7-CVE-2020-8597.patch new file mode 100644 index 0000000..5d7c51b --- /dev/null +++ b/ppp-2.4.7-CVE-2020-8597.patch @@ -0,0 +1,37 @@ +From 8d7970b8f3db727fe798b65f3377fe6787575426 Mon Sep 17 00:00:00 2001 +From: Paul Mackerras +Date: Mon, 3 Feb 2020 15:53:28 +1100 +Subject: [PATCH] pppd: Fix bounds check in EAP code + +Given that we have just checked vallen < len, it can never be the case +that vallen >= len + sizeof(rhostname). This fixes the check so we +actually avoid overflowing the rhostname array. + +Reported-by: Ilja Van Sprundel +Signed-off-by: Paul Mackerras +--- + pppd/eap.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/pppd/eap.c b/pppd/eap.c +index 94407f56..1b93db01 100644 +--- a/pppd/eap.c ++++ b/pppd/eap.c +@@ -1420,7 +1420,7 @@ int len; + } + + /* Not so likely to happen. */ +- if (vallen >= len + sizeof (rhostname)) { ++ if (len - vallen >= sizeof (rhostname)) { + dbglog("EAP: trimming really long peer name down"); + BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); + rhostname[sizeof (rhostname) - 1] = '\0'; +@@ -1846,7 +1846,7 @@ int len; + } + + /* Not so likely to happen. */ +- if (vallen >= len + sizeof (rhostname)) { ++ if (len - vallen >= sizeof (rhostname)) { + dbglog("EAP: trimming really long peer name down"); + BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); + rhostname[sizeof (rhostname) - 1] = '\0'; diff --git a/ppp.spec b/ppp.spec index 97715b7..086b66e 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.7 -Release: 33%{?dist} +Release: 34%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -54,6 +54,7 @@ Patch0029: ppp-2.4.7-DES-openssl.patch # https://github.com/paulusmack/ppp/pull/95 Patch0030: ppp-2.4.7-honor-ldflags.patch Patch0031: ppp-2.4.7-coverity-scan-fixes.patch +Patch0032: ppp-2.4.7-CVE-2020-8597.patch BuildRequires: gcc BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel @@ -184,6 +185,10 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Fri Feb 21 2020 Jaroslav Škarvada - 2.4.7-34 +- Fixed buffer overflow in the eap_request and eap_response functions + Resolves: CVE-2020-8597 + * Thu Jan 30 2020 Fedora Release Engineering - 2.4.7-33 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild