mirror of
https://github.com/openwrt/openwrt.git
synced 2026-10-12 06:57:57 +04:00
Hauke Mehrtens
b2cca02d47
ead-client trusts several length and index fields taken straight from the network when handling server responses, before authentication has completed. Since the client sends its requests as UDP broadcasts and never validates the origin of the replies, any host on the same L2 segment can spoof the whole handshake and hit these paths. handle_prime() copies sb->len bytes into saltbuf[MAXSALTLEN] (32 bytes) without checking the length, and passes sb->prime to t_getpreparam() without a range check. Both come from the wire, so a salt length up to 255 overflows saltbuf and a prime index up to 255 reads (and writes) out of bounds in the precompiled parameter table. This is GHSA-mq4v-mf82-24rr. handle_b() computes the copy length as msg->len - sizeof(number) and memcpy()s it into bbuf[MAXPARAMLEN] with no bounds check. msg->len is attacker controlled and only capped by the 1500 byte receive buffer, so up to 1479 bytes land in the 256 byte bbuf. A msg->len of 0 makes the signed length -1, which memcpy() treats as SIZE_MAX. This is GHSA-8f8g-5c8x-8mhh. handle_pong() writes the NUL terminator at pong->name[len] using an unchecked length, allowing a one byte write past msgbuf, and the receive loop's length check could wrap for a large msg->len. Bound every length against its destination buffer and range check the prime index, mirroring the checks already present on the daemon side in ead.c (handle_send_a(), commit63c0767f3d). ead-client is not installed into images by the ead package, only the daemon is, so this only affects administrators who build and run the client by hand. Link: https://github.com/openwrt/openwrt/security/advisories/GHSA-mq4v-mf82-24rr Link: https://github.com/openwrt/openwrt/security/advisories/GHSA-8f8g-5c8x-8mhh Fixes:2d86ea2a1d("add the 'ead' package (emergency access daemon), which can provide remote access to your device, even if the ip and firewall settings are broken") Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/openwrt/pull/25492 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
56 lines
1.2 KiB
Makefile
56 lines
1.2 KiB
Makefile
#
|
|
# Copyright (C) 2006-2008 OpenWrt.org
|
|
#
|
|
# This is free software, licensed under the GNU General Public License v2.
|
|
# See /LICENSE for more information.
|
|
#
|
|
|
|
include $(TOPDIR)/rules.mk
|
|
|
|
PKG_NAME:=ead
|
|
PKG_RELEASE:=3
|
|
|
|
PKG_BUILD_DEPENDS:=libpcap
|
|
PKG_BUILD_DIR:=$(BUILD_DIR)/ead
|
|
|
|
PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
|
|
PKG_LICENSE:=GPL-2.0
|
|
PKG_FIXUP:=autoreconf
|
|
|
|
include $(INCLUDE_DIR)/package.mk
|
|
include $(INCLUDE_DIR)/kernel.mk
|
|
|
|
define Package/ead
|
|
SECTION:=net
|
|
CATEGORY:=Base system
|
|
TITLE:=Emergency Access Daemon
|
|
URL:=https://bridge.sourceforge.net/
|
|
endef
|
|
|
|
define Package/ead/description
|
|
Provides remote access to your device even if IP and firewall
|
|
configuration settings are defunct
|
|
endef
|
|
|
|
CONFIGURE_PATH = tinysrp
|
|
|
|
TARGET_CFLAGS += \
|
|
-I$(PKG_BUILD_DIR) \
|
|
-I$(PKG_BUILD_DIR)/tinysrp \
|
|
$(TARGET_CPPFLAGS) \
|
|
-Wno-error=implicit-function-declaration
|
|
|
|
MAKE_FLAGS += \
|
|
CONFIGURE_ARGS="$(CONFIGURE_ARGS)" \
|
|
LIBS_EADCLIENT="$(PKG_BUILD_DIR)/tinysrp/libtinysrp.a" \
|
|
LIBS_EAD="$(PKG_BUILD_DIR)/tinysrp/libtinysrp.a $(STAGING_DIR)/usr/lib/libpcap.a" \
|
|
CFLAGS="$(TARGET_CFLAGS)" \
|
|
LDFLAGS="$(TARGET_LDFLAGS)"
|
|
|
|
define Package/ead/install
|
|
$(INSTALL_DIR) $(1)/sbin
|
|
$(INSTALL_BIN) $(PKG_BUILD_DIR)/ead $(1)/sbin/
|
|
endef
|
|
|
|
$(eval $(call BuildPackage,ead))
|