From 044aeedb4476d4b27eb886098450dd49ee2334fd Mon Sep 17 00:00:00 2001 From: starlet-dx <15929766099@163.com> Date: Mon, 27 Mar 2023 17:31:48 +0800 Subject: [PATCH] Fix CVE-2023-1161 (cherry picked from commit 5674f6173eeec4b20e4a252b92e2750bf5fe7f8c) --- CVE-2023-1161.patch | 61 +++++++++++++++++++++++++++++++++++++++++++++ wireshark.spec | 6 ++++- 2 files changed, 66 insertions(+), 1 deletion(-) create mode 100644 CVE-2023-1161.patch diff --git a/CVE-2023-1161.patch b/CVE-2023-1161.patch new file mode 100644 index 0000000..94b2a90 --- /dev/null +++ b/CVE-2023-1161.patch @@ -0,0 +1,61 @@ +From 51e23ea7fd49cb04ba33db3bfbeba690a2f7c5b4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Dr=2E=20Lars=20V=C3=B6lker?= + +Date: Fri, 3 Feb 2023 19:42:03 +0100 +Subject: [PATCH] ISO15765/ISO10681 memory corruption bugfix + +Fixes a situation in which the code wrote behind the frag_id_high array +and corrupted memory. + +Closes #18839 +--- + epan/dissectors/packet-iso10681.c | 7 ++++++- + epan/dissectors/packet-iso15765.c | 8 ++++++-- + 2 files changed, 12 insertions(+), 3 deletions(-) + +diff --git a/epan/dissectors/packet-iso10681.c b/epan/dissectors/packet-iso10681.c +index 9e749eea8cf..6772e936e06 100644 +--- a/epan/dissectors/packet-iso10681.c ++++ b/epan/dissectors/packet-iso10681.c +@@ -340,7 +340,12 @@ dissect_iso10681(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint32 fr + } + + if (!(pinfo->fd->visited)) { +- frag_id += ((iso10681_frame->frag_id_high[frag_id]++) * 16); ++ DISSECTOR_ASSERT(frag_id < 16); ++ guint16 tmp = iso10681_frame->frag_id_high[frag_id]++; ++ /* Make sure that we assert on using more than 4096 (16*255) segments.*/ ++ DISSECTOR_ASSERT(iso10681_frame->frag_id_high[frag_id] != 0); ++ frag_id += tmp * 16; ++ + /* Save the frag_id for subsequent dissection */ + iso10681_info->frag_id = frag_id; + } +diff --git a/epan/dissectors/packet-iso15765.c b/epan/dissectors/packet-iso15765.c +index 3157397bf21..4c73927c807 100644 +--- a/epan/dissectors/packet-iso15765.c ++++ b/epan/dissectors/packet-iso15765.c +@@ -573,14 +573,18 @@ dissect_iso15765(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint32 bu + tvbuff_t *new_tvb = NULL; + iso15765_frame_t *iso15765_frame; + guint16 frag_id = frag_id_low; +- + /* Get frame information */ + iso15765_frame = (iso15765_frame_t *)wmem_map_lookup(iso15765_frame_table, + GUINT_TO_POINTER(iso15765_info->seq)); + + if (iso15765_frame != NULL) { + if (!(pinfo->fd->visited)) { +- frag_id += ((iso15765_frame->frag_id_high[frag_id]++) * 16); ++ DISSECTOR_ASSERT(frag_id < 16); ++ guint16 tmp = iso15765_frame->frag_id_high[frag_id]++; ++ /* Make sure that we assert on using more than 4096 (16*255) segments.*/ ++ DISSECTOR_ASSERT(iso15765_frame->frag_id_high[frag_id] != 0); ++ frag_id += tmp * 16; ++ + /* Save the frag_id for subsequent dissection */ + iso15765_info->frag_id = frag_id; + +-- +GitLab + diff --git a/wireshark.spec b/wireshark.spec index cea2469..db045a9 100644 --- a/wireshark.spec +++ b/wireshark.spec @@ -5,7 +5,7 @@ Summary: Network traffic analyzer Name: wireshark Version: 3.6.11 -Release: 1 +Release: 2 Epoch: 1 License: GPL+ Url: http://www.wireshark.org/ @@ -21,6 +21,7 @@ Patch4: wireshark-0004-Restore-Fedora-specific-groups.patch Patch5: wireshark-0005-Fix-paths-in-a-wireshark.desktop-file.patch Patch6: wireshark-0006-Move-tmp-to-var-tmp.patch Patch7: wireshark-0007-cmakelists.patch +Patch8: CVE-2023-1161.patch Requires: xdg-utils Requires: hicolor-icon-theme @@ -195,6 +196,9 @@ exit 0 %{_mandir}/man?/* %changelog +* Mon Mar 27 2023 yaoxin - 1:3.6.11-2 +- Fix CVE-2023-1161 + * Tue Feb 14 2023 liyuxiang - 1:3.6.11-1 - Update to 3.6.11 -- Gitee