admin/ipmitool/patches/0006-CVE-2020-5208-fru-Fix-buffer-overflow-vulnerabilities.patch

   1 From 960dbb956d9f9cb05b719087faed53c88dc80956 Mon Sep 17 00:00:00 2001
   2 From: Chrostoper Ertl <chertl@microsoft.com>
   3 Date: Thu, 28 Nov 2019 16:33:59 +0000
   4 Subject: [PATCH 06/11] fru: Fix buffer overflow vulnerabilities
   5
   6 Partial fix for CVE-2020-5208, see
   7 https://github.com/ipmitool/ipmitool/security/advisories/GHSA-g659-9qxw-p7cp
   8
   9 The `read_fru_area_section` function only performs size validation of
  10 requested read size, and falsely assumes that the IPMI message will not
  11 respond with more than the requested amount of data; it uses the
  12 unvalidated response size to copy into `frubuf`. If the response is
  13 larger than the request, this can result in overflowing the buffer.
  14
  15 The same issue affects the `read_fru_area` function.
  16 ---
  17  lib/ipmi_fru.c | 33 +++++++++++++++++++++++++++++++--
  18  1 file changed, 31 insertions(+), 2 deletions(-)
  19
  20 diff --git a/lib/ipmi_fru.c b/lib/ipmi_fru.c
  21 index cf00effc82a2..af99aa99444c 100644
  22 --- a/lib/ipmi_fru.c
  23 +++ b/lib/ipmi_fru.c
  24 @@ -615,7 +615,10 @@ int
  25  read_fru_area(struct ipmi_intf * intf, struct fru_info *fru, uint8_t id,
  26                         uint32_t offset, uint32_t length, uint8_t *frubuf)
  27  {
  28 -       uint32_t off = offset, tmp, finish;
  29 +       uint32_t off = offset;
  30 +       uint32_t tmp;
  31 +       uint32_t finish;
  32 +       uint32_t size_left_in_buffer;
  33         struct ipmi_rs * rsp;
  34         struct ipmi_rq req;
  35         uint8_t msg_data[4];
  36 @@ -628,10 +631,12 @@ read_fru_area(struct ipmi_intf * intf, struct fru_info *fru, uint8_t id,
  37
  38         finish = offset + length;
  39         if (finish > fru->size) {
  40 +               memset(frubuf + fru->size, 0, length - fru->size);
  41                 finish = fru->size;
  42                 lprintf(LOG_NOTICE, "Read FRU Area length %d too large, "
  43                         "Adjusting to %d",
  44                         offset + length, finish - offset);
  45 +               length = finish - offset;
  46         }
  47
  48         memset(&req, 0, sizeof(req));
  49 @@ -667,6 +672,7 @@ read_fru_area(struct ipmi_intf * intf, struct fru_info *fru, uint8_t id,
  50                 }
  51         }
  52
  53 +       size_left_in_buffer = length;
  54         do {
  55                 tmp = fru->access ? off >> 1 : off;
  56                 msg_data[0] = id;
  57 @@ -707,9 +713,18 @@ read_fru_area(struct ipmi_intf * intf, struct fru_info *fru, uint8_t id,
  58                 }
  59
  60                 tmp = fru->access ? rsp->data[0] << 1 : rsp->data[0];
  61 +               if(rsp->data_len < 1
  62 +                  || tmp > rsp->data_len - 1
  63 +                  || tmp > size_left_in_buffer)
  64 +               {
  65 +                       printf(" Not enough buffer size");
  66 +                       return -1;
  67 +               }
  68 +
  69                 memcpy(frubuf, rsp->data + 1, tmp);
  70                 off += tmp;
  71                 frubuf += tmp;
  72 +               size_left_in_buffer -= tmp;
  73                 /* sometimes the size returned in the Info command
  74                 * is too large.  return 0 so higher level function
  75                 * still attempts to parse what was returned */
  76 @@ -742,7 +757,9 @@ read_fru_area_section(struct ipmi_intf * intf, struct fru_info *fru, uint8_t id,
  77                         uint32_t offset, uint32_t length, uint8_t *frubuf)
  78  {
  79         static uint32_t fru_data_rqst_size = 20;
  80 -       uint32_t off = offset, tmp, finish;
  81 +       uint32_t off = offset;
  82 +       uint32_t tmp, finish;
  83 +       uint32_t size_left_in_buffer;
  84         struct ipmi_rs * rsp;
  85         struct ipmi_rq req;
  86         uint8_t msg_data[4];
  87 @@ -755,10 +772,12 @@ read_fru_area_section(struct ipmi_intf * intf, struct fru_info *fru, uint8_t id,
  88
  89         finish = offset + length;
  90         if (finish > fru->size) {
  91 +               memset(frubuf + fru->size, 0, length - fru->size);
  92                 finish = fru->size;
  93                 lprintf(LOG_NOTICE, "Read FRU Area length %d too large, "
  94                         "Adjusting to %d",
  95                         offset + length, finish - offset);
  96 +               length = finish - offset;
  97         }
  98
  99         memset(&req, 0, sizeof(req));
 100 @@ -773,6 +792,8 @@ read_fru_area_section(struct ipmi_intf * intf, struct fru_info *fru, uint8_t id,
 101         if (fru->access && fru_data_rqst_size > 16)
 102  #endif
 103                 fru_data_rqst_size = 16;
 104 +
 105 +       size_left_in_buffer = length;
 106         do {
 107                 tmp = fru->access ? off >> 1 : off;
 108                 msg_data[0] = id;
 109 @@ -804,8 +825,16 @@ read_fru_area_section(struct ipmi_intf * intf, struct fru_info *fru, uint8_t id,
 110                 }
 111
 112                 tmp = fru->access ? rsp->data[0] << 1 : rsp->data[0];
 113 +               if(rsp->data_len < 1
 114 +                  || tmp > rsp->data_len - 1
 115 +                  || tmp > size_left_in_buffer)
 116 +               {
 117 +                       printf(" Not enough buffer size");
 118 +                       return -1;
 119 +               }
 120                 memcpy((frubuf + off)-offset, rsp->data + 1, tmp);
 121                 off += tmp;
 122 +               size_left_in_buffer -= tmp;
 123
 124                 /* sometimes the size returned in the Info command
 125                 * is too large.  return 0 so higher level function
 126 --
 127 2.27.0
 128