Comments (11)
@zambbo Thank you for raising this. I believe that (adding in if (coap_pdu_resize(pdu, pdu->used_size + 1)) {
wrapper)
diff --git a/src/net.c b/src/net.c
index e62eaa67..ac429bc9 100644
--- a/src/net.c
+++ b/src/net.c
@@ -1287,17 +1287,19 @@ coap_send_internal(coap_session_t *session, coap_pdu_t *pdu) {
/* Need to check that we are not seeing this proxy in the return loop */
if (pdu->data && opt == NULL) {
if (pdu->used_size + 1 <= pdu->max_size) {
- char *a_match;
- size_t data_len = pdu->used_size - (pdu->data - pdu->token);
- pdu->data[data_len] = '\000';
- a_match = strstr((char*)pdu->data, cp);
- if (a_match && (a_match == (char*)pdu->data || a_match[-1] == ' ') &&
- ((size_t)(a_match - (char*)pdu->data + len) == data_len ||
- a_match[len] == ' ')) {
- coap_log_warn("Proxy loop detected '%s'\n",
- (char*)pdu->data);
- coap_delete_pdu(pdu);
- return (coap_mid_t)COAP_DROPPED_RESPONSE;
+ if (coap_pdu_resize(pdu, pdu->used_size + 1)) {
+ char *a_match;
+ size_t data_len = pdu->used_size - (pdu->data - pdu->token);
+ pdu->data[data_len] = '\000';
+ a_match = strstr((char*)pdu->data, cp);
+ if (a_match && (a_match == (char*)pdu->data || a_match[-1] == ' ') &&
+ ((size_t)(a_match - (char*)pdu->data + len) == data_len ||
+ a_match[len] == ' ')) {
+ coap_log_warn("Proxy loop detected '%s'\n",
+ (char*)pdu->data);
+ coap_delete_pdu(pdu);
+ return (coap_mid_t)COAP_DROPPED_RESPONSE;
+ }
}
}
}
should fix your issue. Please confirm
from libcoap.
After modifying the code, there are no errors occurring.
from libcoap.
Fixed (in slightly re-worked code) in #1065.
from libcoap.
Is there a respective release for 4.3.1+ planned which does include this fix?
This issue has got the CVE number CVE-2023-3062 assigned and typically fixed versions will get prepared by the upstream projects to handle such issues. Note that only the CVE fix is targeted by such releases!
I've tried to cherry pick the underlying commit on top of tag v4.3.1 but this is failing as the code has changed afterwards in src/net.c. I'll need help from the upstream project to prepare fixed version for Debian.
BTW: The GitHub project of libcoap could benefit if there would be some information available in case security issues need to get reported. There is no further information available on https://github.com/obgm/libcoap/security
from libcoap.
@tijuca Thanks for raising this - I was not aware of this CVE. The code that fixes this for 4.3.1 is
iff --git a/src/net.c b/src/net.c
index 9885944..e259ab0 100644
--- a/src/net.c
+++ b/src/net.c
@@ -1305,19 +1305,27 @@ coap_send_internal(coap_session_t *session, coap_pdu_t *pdu)
/* Need to check that we are not seeing this proxy in the return loop */
if (pdu->data && opt == NULL) {
- if (pdu->used_size + 1 <= pdu->max_size) {
- char *a_match;
- size_t data_len = pdu->used_size - (pdu->data - pdu->token);
- pdu->data[data_len] = '\000';
- a_match = strstr((char*)pdu->data, cp);
- if (a_match && (a_match == (char*)pdu->data || a_match[-1] == ' ') &&
- ((size_t)(a_match - (char*)pdu->data + len) == data_len ||
- a_match[len] == ' ')) {
- coap_log(LOG_WARNING, "Proxy loop detected '%s'\n",
- (char*)pdu->data);
- coap_delete_pdu(pdu);
- return (coap_mid_t)COAP_DROPPED_RESPONSE;
- }
+ char *a_match;
+ size_t data_len;
+
+ if (pdu->used_size + 1 > pdu->max_size) {
+ /* No space */
+ return (coap_mid_t)COAP_DROPPED_RESPONSE;
+ }
+ if (!coap_pdu_resize(pdu, pdu->used_size + 1)) {
+ /* Internal error */
+ return (coap_mid_t)COAP_DROPPED_RESPONSE;
+ }
+ data_len = pdu->used_size - (pdu->data - pdu->token);
+ pdu->data[data_len] = '\000';
+ a_match = strstr((char*)pdu->data, cp);
+ if (a_match && (a_match == (char*)pdu->data || a_match[-1] == ' ') &&
+ ((size_t)(a_match - (char*)pdu->data + len) == data_len ||
+ a_match[len] == ' ')) {
+ coap_log(LOG_WARNING, "Proxy loop detected '%s'\n",
+ (char*)pdu->data);
+ coap_delete_pdu(pdu);
+ return (coap_mid_t)COAP_DROPPED_RESPONSE;
}
}
if (pdu->used_size + len + 1 <= pdu->max_size) {
I see also that CVE-2023-35862 has been published (which I did know was likely to happen) but this is for code post 4.3.1.
It is currently planned to release 4.3.2 when #611 is signed off and merged. However, what is the best way to name an interim release that contains CVE-2023-30362 if I was to do that to help you?
from libcoap.
Thanks for the diff, that's what I was needing. I've prepared a new Debian version 4.3.1-2 which is including the fix for CVE-2023-30362.
Newer usptream versions are targeted for unstable/sid
and migrate then to testing
. The version in the stable releases of Debian do not change normally. CVE fixes or regressions get fixed by only fixing the underlying problem. Newer versions for the stable release can be provided by the backports
archive (which I've done regularly in the past).
The other CVE issue I need to compare with the security team. But I suspect this this get need to be fixed the same as this one here.
from libcoap.
The other CVE issue I need to compare with the security team. But I suspect this this get need to be fixed the
same as this one here.
The code in question (OSCORE support) is not in the 4.3.1 release, only in the develop branch.
from libcoap.
Then this doesn't affects the current version in Debian stable. Thanks for clear out.
from libcoap.
Hi.
I have a version libcoap 4.2.1.
Is this version affected by this CVE?
Function coap_send_internal is not present here. Can you provide a patch if this version is affected?
Thanks
from libcoap.
4.2.1 is not affected. This issue was introduced when support for RFC8768 was added (4.3.0).
from libcoap.
Ok. Thanks for you confirmation on my suspects.
from libcoap.
Related Issues (20)
- Request token is unexpectedly replaced with nonsense HOT 15
- Q-Block support detection fails in some cases HOT 5
- [Non-conformance] Handling CoAP Invalid Versions HOT 2
- No callback if DTLS connection with OpenSSL server and client fails due to PSK mismatch HOT 3
- Add coap_get_resource_from_uri_path() to man pages. HOT 2
- HTTP/S Support for Proxy URIs in CoAP to HTTP Proxy HOT 4
- [Non-conformance] Handling Unreapeatable Options HOT 1
- Incorrect header passed to response_handler after finishing Replay Window scenario. HOT 7
- Actively denying a new session HOT 4
- Failing to set mtu when WOLFSSL_DTLS_MTU is enabled HOT 1
- Assertion !lock->in_callback failed in coap_lock_lock_func() during application shutdown HOT 10
- Build with wolfSSL not loading certificates on server side HOT 3
- Memory leak in LwIP function `coap_udp_recvs` HOT 1
- PDU use after free when sending an OSCORE message with OSCORE disabled at build time HOT 5
- coap-client binary PSK HOT 17
- [Question] Proxy-scheme and proxy-uri example with coap-client and coap-server applications HOT 6
- Make coap_print_wellknown customizable HOT 6
- Wrong
- Access Token option addition to libcoap HOT 1
- Clarification on cancelling a block-wise request in the middle of transaction at client's end HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from libcoap.