The initial option-scanning loop in dhcp(), so far, ignored options 0
(Pad Option, RFC 2132, Section 3.1) and 255 (End Option, RFC 2132,
Section 3.2).
As a result:
- if we ever encountered option 0 in the middle of option fields
(never seen in practice), we would potentially terminate the loop
too early, before scanning remaining options
- a malformed message with an option 255 followed by a length byte
would (reliably) cause us to terminate as we would exceed the
allocated size for the 'opts' array, which is detected as buffer
overflow by the FORTIFY_SOURCE mechanism
The latter was reported as potential vulnerability by AISLE, but it's
not actually a vulnerability as we always terminate without carrying
on further handling, and in our security model the guest is able to
sabotage its own connectivity in any case (for example, a malformed
frame from the hypervisor would cause us to reset the connection, or
entirely flooding the flow table would cause inbound connectivity to
stop working, etc.).
The reported behaviour, however, is indeed a defect, as it affects
the functional robustness to a hypothetical issue in a DHCP client,
and that's something we definitely want to fix.
Make the option parsing loop more robust by:
- resizing 'opts' from 255 to 256 elements: there's no particular
reason to try to save a tiny bit of memory (which shouldn't even
be allocated in practice) instead of being defensive about it
- explicitly handle options 0 (skip one byte, continue) and 255 (stop
processing options) in the option-scanning loop
This bug was found and an initial version of the patch was written by
the AISLE AI security scanning tool (https://aisle.com/platform).
Reported-by: AISLE
Signed-off-by: Stefano Brivio