Fedora has issued an advisory on June 24: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4YAT4AGTHQKB74ETOQPJMV67TSDIAPOC/ Mageia 7 is also affected.
Whiteboard: (none) => MGA7TOO
Fixed upstream in 4.3.3 release. Done for both Cauldron and mga7!
CC: (none) => geiger.david68210
Advisory: ======================== Updated tcpreplay package fixes security vulnerability: tcprewrite in Tcpreplay through 4.3.2 has a heap-based buffer over-read during a get_c operation. The issue is being triggered in the function get_ipv6_next() at common/get.c (CVE-2020-12740). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12740 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4YAT4AGTHQKB74ETOQPJMV67TSDIAPOC/ ======================== Updated packages in core/updates_testing: ======================== tcpreplay-4.3.3-1.mga7 from tcpreplay-4.3.3-1.mga7.src.rpm
Whiteboard: MGA7TOO => (none)Assignee: bugsquad => qa-bugsVersion: Cauldron => 7
CVE-2020-12740 https://github.com/appneta/tcpreplay/issues/576 Leads to three files: https://github.com/14isnot40/vul_discovery/tree/master/tcpreplay/get_ipv6_next/poc etc. tcpreplay 4.3.2 $ tcprewrite -i poc1 -o /dev/null --fuzz-seed=42 Segfault with the fuzz-seed, nothing otherwise. The extra parameter probably does not mean anything unless the package is compiled with asan support. Updated the package. tcpreplay 4.3.3 $ tcprewrite -i poc1 -o /dev/null --fuzz-seed=42 Fatal Error: Error rewriting packets: From edit_packet.c:fix_ipv4_checksums() line 73: Invalid packet: Expected IPv4 packet: got 6 Without fuzzer parameter: $ tcprewrite -i poc1 -o /dev/null $ So maybe this is a good PoC test. Cannot be certain. -------------------------------------------------------- $ tcprewrite --infile=test1.pcap --outfile=new.pcap $ ll test1.pcap new.pcap -rw-r--r-- 1 lcl lcl 202121 Jul 4 02:20 new.pcap -rw-r--r-- 1 lcl lcl 202121 Jul 4 01:51 test1.pcap Note: not the way it is intended to be used (just a copy as it stands). There are many options, all a bit technical. $ tcpreplay --listnics vailable network interfaces: enp3s0 any bluetooth-monitor nflog nfqueue bluetooth0 $ tcprewrite --infile=test2.pcap --outfile=new.pcap Warning: test2.pcap was captured using a snaplen of 500 bytes. This may mean you have truncated packets. # tcpreplay -i enp3s0 test2.pcap Warning: test2.pcap was captured using a snaplen of 500 bytes. This may mean you have truncated packets. ^C User interrupt... sendpacket_abort Actual: 55 packets (13156 bytes) sent in 52.14 seconds Rated: 252.3 Bps, 0.002 Mbps, 1.05 pps Flows: 1 flows, 0.01 fps, 55 flow packets, 0 non-flow Statistics for network device: enp3s0 Successful packets: 54 Failed packets: 0 Truncated packets: 0 Retried packets (ENOBUFS): 0 Retried packets (EAGAIN): 0 # tcpreplay -v -i enp3s0 test2.pcap Warning: test2.pcap was captured using a snaplen of 500 bytes. This may mean you have truncated packets. reading from file -, link-type EN10MB (Ethernet) 01:00:00.000000 IP 208.21.2.184.1512 > 10.1.1.99.53: 12295 updateMA Resp12*-| [30980q][|domain] 01:00:01.000001 IP truncated-ip - 27 bytes missing! 208.21.2.184.1512 > 10.1.1.99.53: [|domain] 01:00:02.000002 IP 208.21.2.184.1512 > 10.1.1.99.53: 12337 op7 NoChange- [6466q][|domain] 01:00:03.000003 IP 208.21.2.184.1512 > 10.1.1.99.53: 12316 updateM [b2&3=0x6440] [7904a] [8443q] [35785n] [14306au] Type39694 (Class 9587)? <BAD PTR>[|domain] [...] ^C User interrupt... sendpacket_abort tcpdump: pcap_loop: error reading dump file: Interrupted system call Actual: 8 packets (1959 bytes) sent in 5.78 seconds Rated: 338.8 Bps, 0.002 Mbps, 1.38 pps Flows: 1 flows, 0.17 fps, 8 flow packets, 0 non-flow Statistics for network device: enp3s0 Successful packets: 7 Failed packets: 0 Truncated packets: 0 Retried packets (ENOBUFS): 0 Retried packets (EAGAIN): 0 That is as far as we can take it. Good enough hopefully.
Whiteboard: (none) => MGA7-64-OKCC: (none) => tarazed25
Taking your word for it, Len. Validating. Advisory in Comment 2.
Keywords: (none) => validated_updateCC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => advisoryCC: (none) => mageia
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2020-0278.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED