Fix for CVE-2014-0195
authorDr. Stephen Henson <steve@openssl.org>
Tue, 13 May 2014 17:48:31 +0000 (18:48 +0100)
committerDr. Stephen Henson <steve@openssl.org>
Tue, 3 Jun 2014 15:30:37 +0000 (16:30 +0100)
A buffer overrun attack can be triggered by sending invalid DTLS fragments
to an OpenSSL DTLS client or server. This is potentially exploitable to
run arbitrary code on a vulnerable client or server.

Fixed by adding consistency check for DTLS fragments.

Thanks to Jüri Aedla for reporting this issue.

ssl/d1_both.c

index ffbff8c73304b604a8851b6678805cff6e658a45..da8d1b146951aa5aa41d39052c4540a65a3d68cb 100644 (file)
@@ -627,7 +627,16 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok)
                frag->msg_header.frag_off = 0;
                }
        else
+               {
                frag = (hm_fragment*) item->data;
+               if (frag->msg_header.msg_len != msg_hdr->msg_len)
+                       {
+                       item = NULL;
+                       frag = NULL;
+                       goto err;
+                       }
+               }
+
 
        /* If message is already reassembled, this must be a
         * retransmit and can be dropped.