From 619ea4c46204242f9c523259d7bbe7b94c69fd63 Mon Sep 17 00:00:00 2001 From: changtao Date: Fri, 20 Sep 2024 22:54:39 +0800 Subject: [PATCH] fix-CVE-2024-41184 --- fix-CVE-2024-41184.patch | 96 ++++++++++++++++++++++++++++++++++++++++ keepalived.spec | 9 +++- 2 files changed, 104 insertions(+), 1 deletion(-) create mode 100644 fix-CVE-2024-41184.patch diff --git a/fix-CVE-2024-41184.patch b/fix-CVE-2024-41184.patch new file mode 100644 index 0000000..eed9d83 --- /dev/null +++ b/fix-CVE-2024-41184.patch @@ -0,0 +1,96 @@ +From e78513fe0ce5d83c226ea2c0bd222f375c2438e7 Mon Sep 17 00:00:00 2001 +From: Quentin Armitage +Date: Fri, 20 Sep 2024 22:48:27 +0800 +Subject: [PATCH] fix CVE-2024-41184 +Handle empty ipset names with vrrp_ipsets keyword +We now handle empty ipset names and return a config error. +--- + keepalived/core/global_parser.c | 36 +++++++++++++++++++-------------- + 1 file changed, 21 insertions(+), 15 deletions(-) + +diff --git a/keepalived/core/global_parser.c b/keepalived/core/global_parser.c +index 5d269f0..81d8a5d 100644 +--- a/keepalived/core/global_parser.c ++++ b/keepalived/core/global_parser.c +@@ -1039,6 +1039,22 @@ vrrp_iptables_handler(const vector_t *strvec) + } + } + #ifdef _HAVE_LIBIPSET_ ++static bool ++check_valid_ipset_name(const vector_t *strvec, unsigned entry, const char *log_name) ++{ ++ if (strlen(strvec_slot(strvec, entry)) >= IPSET_MAXNAMELEN - 1) { ++ report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : ipset %s name too long - ignored", log_name); ++ return false; ++ } ++ ++ if (strlen(strvec_slot(strvec, entry)) == 0) { ++ report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : ipset %s name empty - ignored", log_name); ++ return false; ++ } ++ ++ return true; ++} ++ + static void + vrrp_ipsets_handler(const vector_t *strvec) + { +@@ -1056,17 +1072,13 @@ vrrp_ipsets_handler(const vector_t *strvec) + return; + } + +- if (strlen(strvec_slot(strvec,1)) >= IPSET_MAXNAMELEN - 1) { +- report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : ipset address name too long - ignored"); ++ if (!check_valid_ipset_name(strvec, 1, "address")) + return; +- } + global_data->vrrp_ipset_address = STRDUP(strvec_slot(strvec,1)); + + if (vector_size(strvec) >= 3) { +- if (strlen(strvec_slot(strvec,2)) >= IPSET_MAXNAMELEN - 1) { +- report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : ipset IPv6 address name too long - ignored"); ++ if (!check_valid_ipset_name(strvec, 2, "IPv6 address")) + return; +- } + global_data->vrrp_ipset_address6 = STRDUP(strvec_slot(strvec,2)); + } + else { +@@ -1077,10 +1089,8 @@ vrrp_ipsets_handler(const vector_t *strvec) + global_data->vrrp_ipset_address6 = STRDUP(set_name); + } + if (vector_size(strvec) >= 4) { +- if (strlen(strvec_slot(strvec,3)) >= IPSET_MAXNAMELEN - 1) { +- report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : ipset IPv6 address_iface name too long - ignored"); ++ if (!check_valid_ipset_name(strvec, 3, "IPv6 address_iface")) + return; +- } + global_data->vrrp_ipset_address_iface6 = STRDUP(strvec_slot(strvec,3)); + } + else { +@@ -1095,10 +1105,8 @@ vrrp_ipsets_handler(const vector_t *strvec) + } + + if (vector_size(strvec) >= 5) { +- if (strlen(strvec_slot(strvec,4)) >= IPSET_MAXNAMELEN - 1) { +- report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : ipset IGMP name too long - ignored"); ++ if (!check_valid_ipset_name(strvec, 4, "IGMP")) + return; +- } + global_data->vrrp_ipset_igmp = STRDUP(strvec_slot(strvec,4)); + } + else { +@@ -1109,10 +1117,8 @@ vrrp_ipsets_handler(const vector_t *strvec) + global_data->vrrp_ipset_igmp = STRDUP(set_name); + } + if (vector_size(strvec) >= 6) { +- if (strlen(strvec_slot(strvec,5)) >= IPSET_MAXNAMELEN - 1) { +- report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : ipset MLD name too long - ignored"); ++ if (!check_valid_ipset_name(strvec, 5, "MLD")) + return; +- } + global_data->vrrp_ipset_mld = STRDUP(strvec_slot(strvec,5)); + } + else { +-- +2.43.0 + diff --git a/keepalived.spec b/keepalived.spec index 54d94aa..63f20ad 100644 --- a/keepalived.spec +++ b/keepalived.spec @@ -9,7 +9,7 @@ Name: keepalived Version: 2.2.4 -Release: 4 +Release: 5 Summary: High Availability monitor built upon LVS, VRRP and service pollers License: GPLv2+ URL: http://www.keepalived.org/ @@ -28,6 +28,7 @@ Patch0006: vrrp-deley-freeing-vrrp-instances-until-all-referenc.patch Patch0007: check-use-last-entry-if-duplicate-definition.patch Patch0008: check-fix-further-memory-leaks-when-configuration-is.patch Patch0009: dbus-fix-type-of-name-property-in-interface.patch +Patch0010: fix-CVE-2024-41184.patch Requires(post): systemd Requires(preun): systemd @@ -112,6 +113,12 @@ install -Dd -m 0755 %{buildroot}%{_libexecdir}/keepalived %{_mandir}/man* %changelog +* Wed Sep 25 2024 changtao - 2.2.4-5 +- Type:bugfix +- ID:NA +- SUG:NA +- DESC:fix CVE-2024-41184 + * Thu Aug 10 2023 liubo - 2.2.4-4 - Type:bugfix - ID:NA -- Gitee