1*4882a593SmuzhiyunFrom cd785a7fe4f42ab59bcefcf01b9175f039af29b5 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Chrostoper Ertl <chertl@microsoft.com> 3*4882a593SmuzhiyunDate: Thu, 28 Nov 2019 16:51:49 +0000 4*4882a593SmuzhiyunSubject: [PATCH] session: Fix buffer overflow in ipmi_get_session_info 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunPartial fix for CVE-2020-5208, see 7*4882a593Smuzhiyunhttps://github.com/ipmitool/ipmitool/security/advisories/GHSA-g659-9qxw-p7cp 8*4882a593Smuzhiyun 9*4882a593SmuzhiyunThe `ipmi_get_session_info` function does not properly check the 10*4882a593Smuzhiyunresponse `data_len`, which is used as a copy size, allowing stack buffer 11*4882a593Smuzhiyunoverflow. 12*4882a593Smuzhiyun 13*4882a593Smuzhiyun[Retrieve from: 14*4882a593Smuzhiyunhttps://github.com/ipmitool/ipmitool/commit/41d7026946fafbd4d1ec0bcaca3ea30a6e8eed22] 15*4882a593SmuzhiyunSigned-off-by: Heiko Thiery <heiko.thiery@gmail.com> 16*4882a593Smuzhiyun--- 17*4882a593Smuzhiyun lib/ipmi_session.c | 12 ++++++++---- 18*4882a593Smuzhiyun 1 file changed, 8 insertions(+), 4 deletions(-) 19*4882a593Smuzhiyun 20*4882a593Smuzhiyundiff --git a/lib/ipmi_session.c b/lib/ipmi_session.c 21*4882a593Smuzhiyunindex 141f0f4..b9af1fd 100644 22*4882a593Smuzhiyun--- a/lib/ipmi_session.c 23*4882a593Smuzhiyun+++ b/lib/ipmi_session.c 24*4882a593Smuzhiyun@@ -309,8 +309,10 @@ ipmi_get_session_info(struct ipmi_intf * intf, 25*4882a593Smuzhiyun } 26*4882a593Smuzhiyun else 27*4882a593Smuzhiyun { 28*4882a593Smuzhiyun- memcpy(&session_info, rsp->data, rsp->data_len); 29*4882a593Smuzhiyun- print_session_info(&session_info, rsp->data_len); 30*4882a593Smuzhiyun+ memcpy(&session_info, rsp->data, 31*4882a593Smuzhiyun+ __min(rsp->data_len, sizeof(session_info))); 32*4882a593Smuzhiyun+ print_session_info(&session_info, 33*4882a593Smuzhiyun+ __min(rsp->data_len, sizeof(session_info))); 34*4882a593Smuzhiyun } 35*4882a593Smuzhiyun break; 36*4882a593Smuzhiyun 37*4882a593Smuzhiyun@@ -341,8 +343,10 @@ ipmi_get_session_info(struct ipmi_intf * intf, 38*4882a593Smuzhiyun break; 39*4882a593Smuzhiyun } 40*4882a593Smuzhiyun 41*4882a593Smuzhiyun- memcpy(&session_info, rsp->data, rsp->data_len); 42*4882a593Smuzhiyun- print_session_info(&session_info, rsp->data_len); 43*4882a593Smuzhiyun+ memcpy(&session_info, rsp->data, 44*4882a593Smuzhiyun+ __min(rsp->data_len, sizeof(session_info))); 45*4882a593Smuzhiyun+ print_session_info(&session_info, 46*4882a593Smuzhiyun+ __min(rsp->data_len, sizeof(session_info))); 47*4882a593Smuzhiyun 48*4882a593Smuzhiyun } while (i <= session_info.session_slot_count); 49*4882a593Smuzhiyun break; 50*4882a593Smuzhiyun-- 51*4882a593Smuzhiyun2.20.1 52*4882a593Smuzhiyun 53