Skip to content

Commit a127791

Browse files
CBL-Mariner-BotKavyaSree2610
CBL-Mariner-Bot
and
KavyaSree2610
authored
[AUTO-CHERRYPICK] Fix CVE-2023-7256 and CVE-2024-8006 for nmap: 2.0 - branch main (#11119)
Co-authored-by: KavyaSree2610 <92566732+KavyaSree2610@users.noreply.github.com>
1 parent e5238d9 commit a127791

3 files changed

Lines changed: 342 additions & 2 deletions

File tree

‎SPECS/nmap/CVE-2023-7256.patch‎

Lines changed: 296 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,296 @@
1+
From 609e66296ee162743695b3f2b8a782d3ccfcf08f Mon Sep 17 00:00:00 2001
2+
From: kavyasree <kkaitepalli@microsoft.com>
3+
Date: Mon, 18 Nov 2024 14:45:51 +0530
4+
Subject: [PATCH] Fix CVE-2023-7256
5+
6+
---
7+
libpcap/pcap-rpcap.c | 48 +++++++++++-----------
8+
libpcap/sockutils.c | 96 ++++++++++++++++++++++++++++++++------------
9+
libpcap/sockutils.h | 5 +--
10+
3 files changed, 97 insertions(+), 52 deletions(-)
11+
12+
diff --git a/libpcap/pcap-rpcap.c b/libpcap/pcap-rpcap.c
13+
index 0c6c558..9f152d3 100644
14+
--- a/libpcap/pcap-rpcap.c
15+
+++ b/libpcap/pcap-rpcap.c
16+
@@ -995,7 +995,6 @@ rpcap_remoteact_getsock(const char *host, int *error, char *errbuf)
17+
{
18+
struct activehosts *temp; /* temp var needed to scan the host list chain */
19+
struct addrinfo hints, *addrinfo, *ai_next; /* temp var needed to translate between hostname to its address */
20+
- int retval;
21+
22+
/* retrieve the network address corresponding to 'host' */
23+
addrinfo = NULL;
24+
@@ -1003,9 +1002,9 @@ rpcap_remoteact_getsock(const char *host, int *error, char *errbuf)
25+
hints.ai_family = PF_UNSPEC;
26+
hints.ai_socktype = SOCK_STREAM;
27+
28+
- retval = sock_initaddress(host, "0", &hints, &addrinfo, errbuf,
29+
+ addrinfo = sock_initaddress(host, NULL, &hints, errbuf,
30+
PCAP_ERRBUF_SIZE);
31+
- if (retval != 0)
32+
+ if (addrinfo == NULL)
33+
{
34+
*error = 1;
35+
return NULL;
36+
@@ -1151,7 +1150,9 @@ static int pcap_startcapture_remote(pcap_t *fp)
37+
hints.ai_flags = AI_PASSIVE; /* Data connection is opened by the server toward the client */
38+
39+
/* Let's the server pick up a free network port for us */
40+
- if (sock_initaddress(NULL, "0", &hints, &addrinfo, fp->errbuf, PCAP_ERRBUF_SIZE) == -1)
41+
+ addrinfo = sock_initaddress(NULL, NULL, &hints, fp->errbuf,
42+
+ PCAP_ERRBUF_SIZE);
43+
+ if (addrinfo == NULL)
44+
goto error_nodiscard;
45+
46+
if ((sockdata = sock_open(addrinfo, SOCKOPEN_SERVER,
47+
@@ -1263,7 +1264,9 @@ static int pcap_startcapture_remote(pcap_t *fp)
48+
snprintf(portdata, PCAP_BUF_SIZE, "%d", ntohs(startcapreply.portdata));
49+
50+
/* Let's the server pick up a free network port for us */
51+
- if (sock_initaddress(host, portdata, &hints, &addrinfo, fp->errbuf, PCAP_ERRBUF_SIZE) == -1)
52+
+ addrinfo = sock_initaddress(host, portstring, &hints,
53+
+ fp->errbuf, PCAP_ERRBUF_SIZE);
54+
+ if (addrinfo == NULL)
55+
goto error;
56+
57+
if ((sockdata = sock_open(addrinfo, SOCKOPEN_CLIENT, 0, fp->errbuf, PCAP_ERRBUF_SIZE)) == INVALID_SOCKET)
58+
@@ -2206,16 +2209,16 @@ rpcap_setup_session(const char *source, struct pcap_rmtauth *auth,
59+
if (port[0] == 0)
60+
{
61+
/* the user chose not to specify the port */
62+
- if (sock_initaddress(host, RPCAP_DEFAULT_NETPORT,
63+
- &hints, &addrinfo, errbuf, PCAP_ERRBUF_SIZE) == -1)
64+
- return -1;
65+
+ addrinfo = sock_initaddress(host, RPCAP_DEFAULT_NETPORT,
66+
+ &hints, errbuf, PCAP_ERRBUF_SIZE);
67+
}
68+
else
69+
{
70+
- if (sock_initaddress(host, port, &hints, &addrinfo,
71+
- errbuf, PCAP_ERRBUF_SIZE) == -1)
72+
- return -1;
73+
+ addrinfo = sock_initaddress(host, port, &hints,
74+
+ errbuf, PCAP_ERRBUF_SIZE);
75+
}
76+
+ if (addrinfo == NULL)
77+
+ return -1;
78+
79+
if ((*sockctrlp = sock_open(addrinfo, SOCKOPEN_CLIENT, 0,
80+
errbuf, PCAP_ERRBUF_SIZE)) == INVALID_SOCKET)
81+
@@ -2811,19 +2814,19 @@ SOCKET pcap_remoteact_accept_ex(const char *address, const char *port, const cha
82+
/* Do the work */
83+
if ((port == NULL) || (port[0] == 0))
84+
{
85+
- if (sock_initaddress(address, RPCAP_DEFAULT_NETPORT_ACTIVE, &hints, &addrinfo, errbuf, PCAP_ERRBUF_SIZE) == -1)
86+
- {
87+
- return (SOCKET)-2;
88+
- }
89+
+ addrinfo = sock_initaddress(address,
90+
+ RPCAP_DEFAULT_NETPORT_ACTIVE, &hints, errbuf,
91+
+ PCAP_ERRBUF_SIZE);
92+
}
93+
else
94+
{
95+
- if (sock_initaddress(address, port, &hints, &addrinfo, errbuf, PCAP_ERRBUF_SIZE) == -1)
96+
- {
97+
- return (SOCKET)-2;
98+
- }
99+
+ addrinfo = sock_initaddress(address, port, &hints, errbuf,
100+
+ PCAP_ERRBUF_SIZE);
101+
+ }
102+
+ if (addrinfo == NULL)
103+
+ {
104+
+ return (SOCKET)-2;
105+
}
106+
-
107+
108+
if ((sockmain = sock_open(addrinfo, SOCKOPEN_SERVER, 1, errbuf, PCAP_ERRBUF_SIZE)) == INVALID_SOCKET)
109+
{
110+
@@ -2980,7 +2983,6 @@ int pcap_remoteact_close(const char *host, char *errbuf)
111+
{
112+
struct activehosts *temp, *prev; /* temp var needed to scan the host list chain */
113+
struct addrinfo hints, *addrinfo, *ai_next; /* temp var needed to translate between hostname to its address */
114+
- int retval;
115+
116+
temp = activeHosts;
117+
prev = NULL;
118+
@@ -2991,9 +2993,9 @@ int pcap_remoteact_close(const char *host, char *errbuf)
119+
hints.ai_family = PF_UNSPEC;
120+
hints.ai_socktype = SOCK_STREAM;
121+
122+
- retval = sock_initaddress(host, "0", &hints, &addrinfo, errbuf,
123+
+ addrinfo = sock_initaddress(host, NULL, &hints, errbuf,
124+
PCAP_ERRBUF_SIZE);
125+
- if (retval != 0)
126+
+ if (addrinfo == NULL)
127+
{
128+
return -1;
129+
}
130+
diff --git a/libpcap/sockutils.c b/libpcap/sockutils.c
131+
index ca16bbf..41ecbe8 100644
132+
--- a/libpcap/sockutils.c
133+
+++ b/libpcap/sockutils.c
134+
@@ -704,31 +704,75 @@ get_gai_errstring(char *errbuf, int errbuflen, const char *prefix, int err,
135+
* \param errbuflen: length of the buffer that will contains the error. The error message cannot be
136+
* larger than 'errbuflen - 1' because the last char is reserved for the string terminator.
137+
*
138+
- * \return '0' if everything is fine, '-1' if some errors occurred. The error message is returned
139+
- * in the 'errbuf' variable. The addrinfo variable that has to be used in the following sockets calls is
140+
- * returned into the addrinfo parameter.
141+
+ * \return a pointer to the first element in a list of addrinfo structures
142+
+ * if everything is fine, NULL if some errors occurred. The error message
143+
+ * is returned in the 'errbuf' variable.*
144+
*
145+
- * \warning The 'addrinfo' variable has to be deleted by the programmer by calling freeaddrinfo() when
146+
- * it is no longer needed.
147+
+ * \warning The list of addrinfo structures returned has to be deleted by
148+
+ * the programmer by calling freeaddrinfo() when it is no longer needed.*
149+
*
150+
* \warning This function requires the 'hints' variable as parameter. The semantic of this variable is the same
151+
* of the one of the corresponding variable used into the standard getaddrinfo() socket function. We suggest
152+
* the programmer to look at that function in order to set the 'hints' variable appropriately.
153+
*/
154+
-int sock_initaddress(const char *host, const char *port,
155+
- struct addrinfo *hints, struct addrinfo **addrinfo, char *errbuf, int errbuflen)
156+
-{
157+
+struct addrinfo *sock_initaddress(const char *host, const char *port,
158+
+ struct addrinfo *hints, char *errbuf, int errbuflen)
159+
+{
160+
+ struct addrinfo *addrinfo;
161+
int retval;
162+
163+
- retval = getaddrinfo(host, port, hints, addrinfo);
164+
+ retval = getaddrinfo(host, port == NULL ? "0" : port, hints, &addrinfo);
165+
if (retval != 0)
166+
- {
167+
+ {
168+
+ /*
169+
+ * That call failed.
170+
+ * Determine whether the problem is that the host is bad.
171+
+ */
172+
if (errbuf)
173+
{
174+
- get_gai_errstring(errbuf, errbuflen, "", retval,
175+
- host, port);
176+
+ if (host != NULL && port != NULL) {
177+
+ /*
178+
+ * Try with just a host, to distinguish
179+
+ * between "host is bad" and "port is
180+
+ * bad".
181+
+ */
182+
+ int try_retval;
183+
+
184+
+ try_retval = getaddrinfo(host, NULL, hints,
185+
+ &addrinfo);
186+
+ if (try_retval == 0) {
187+
+ /*
188+
+ * Worked with just the host,
189+
+ * so assume the problem is
190+
+ * with the port.
191+
+ *
192+
+ * Free up the address info first.
193+
+ */
194+
+ freeaddrinfo(addrinfo);
195+
+ get_gai_errstring(errbuf, errbuflen,
196+
+ "", retval, NULL, port);
197+
+ } else {
198+
+ /*
199+
+ * Didn't work with just the host,
200+
+ * so assume the problem is
201+
+ * with the host; we assume
202+
+ * the original error indicates
203+
+ * the underlying problem.
204+
+ */
205+
+ get_gai_errstring(errbuf, errbuflen,
206+
+ "", retval, host, NULL);
207+
+ }
208+
+ } else {
209+
+ /*
210+
+ * Either the host or port was null, so
211+
+ * there's nothing to determine; report
212+
+ * the error from the original call.
213+
+ */
214+
+ get_gai_errstring(errbuf, errbuflen, "",
215+
+ retval, host, port);
216+
+ }
217+
}
218+
- return -1;
219+
+ return NULL;
220+
}
221+
/*
222+
* \warning SOCKET: I should check all the accept() in order to bind to all addresses in case
223+
@@ -740,33 +784,31 @@ int sock_initaddress(const char *host, const char *port,
224+
*
225+
* XXX - should we just check that at least *one* address is
226+
* either PF_INET or PF_INET6, and, when using the list,
227+
- * ignore all addresses that are neither? (What, no IPX
228+
+ * ignore a5;26;57Mll addresses that are neither? (What, no IPX
229+
* support? :-))
230+
*/
231+
- if (((*addrinfo)->ai_family != PF_INET) &&
232+
- ((*addrinfo)->ai_family != PF_INET6))
233+
+ if ((addrinfo->ai_family != PF_INET) &&
234+
+ (addrinfo->ai_family != PF_INET6))
235+
{
236+
if (errbuf)
237+
snprintf(errbuf, errbuflen, "getaddrinfo(): socket type not supported");
238+
- freeaddrinfo(*addrinfo);
239+
- *addrinfo = NULL;
240+
- return -1;
241+
+ freeaddrinfo(addrinfo);
242+
+ return NULL;
243+
}
244+
245+
/*
246+
* You can't do multicast (or broadcast) TCP.
247+
*/
248+
- if (((*addrinfo)->ai_socktype == SOCK_STREAM) &&
249+
- (sock_ismcastaddr((*addrinfo)->ai_addr) == 0))
250+
+ if ((addrinfo->ai_socktype == SOCK_STREAM) &&
251+
+ (sock_ismcastaddr(addrinfo->ai_addr) == 0))
252+
{
253+
if (errbuf)
254+
snprintf(errbuf, errbuflen, "getaddrinfo(): multicast addresses are not valid when using TCP streams");
255+
- freeaddrinfo(*addrinfo);
256+
- *addrinfo = NULL;
257+
- return -1;
258+
+ freeaddrinfo(addrinfo);
259+
+ return NULL;
260+
}
261+
262+
- return 0;
263+
+ return addrinfo;
264+
}
265+
266+
/*
267+
@@ -1676,7 +1718,9 @@ int sock_present2network(const char *address, struct sockaddr_storage *sockaddr,
268+
269+
hints.ai_family = addr_family;
270+
271+
- if ((retval = sock_initaddress(address, "22222" /* fake port */, &hints, &addrinfo, errbuf, errbuflen)) == -1)
272+
+ addrinfo = sock_initaddress(address, "22222" /* fake port */, &hints,
273+
+ errbuf, errbuflen);
274+
+ if (addrinfo == NULL)
275+
return 0;
276+
277+
if (addrinfo->ai_family == PF_INET)
278+
diff --git a/libpcap/sockutils.h b/libpcap/sockutils.h
279+
index e748662..ede86a1 100644
280+
--- a/libpcap/sockutils.h
281+
+++ b/libpcap/sockutils.h
282+
@@ -129,9 +129,8 @@ int sock_init(char *errbuf, int errbuflen);
283+
void sock_cleanup(void);
284+
void sock_fmterror(const char *caller, int errcode, char *errbuf, int errbuflen);
285+
void sock_geterror(const char *caller, char *errbuf, int errbufsize);
286+
-int sock_initaddress(const char *address, const char *port,
287+
- struct addrinfo *hints, struct addrinfo **addrinfo,
288+
- char *errbuf, int errbuflen);
289+
+struct addrinfo *sock_initaddress(const char *address, const char *port,
290+
+ struct addrinfo *hints, char *errbuf, int errbuflen);
291+
int sock_recv(SOCKET sock, SSL *, void *buffer, size_t size, int receiveall,
292+
char *errbuf, int errbuflen);
293+
int sock_recv_dgram(SOCKET sock, SSL *, void *buffer, size_t size,
294+
--
295+
2.34.1
296+

‎SPECS/nmap/CVE-2024-8006.patch‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
From ca7bff938f45390a6f4b62ec66c6d06229bdae04 Mon Sep 17 00:00:00 2001
2+
From: kavyasree <kkaitepalli@microsoft.com>
3+
Date: Mon, 18 Nov 2024 08:04:55 +0530
4+
Subject: [PATCH] Backport fix for CVE-2024-8006
5+
6+
---
7+
libpcap/pcap-new.c | 10 +++++++++-
8+
1 file changed, 9 insertions(+), 1 deletion(-)
9+
10+
diff --git a/libpcap/pcap-new.c b/libpcap/pcap-new.c
11+
index 7c00659..b973290 100644
12+
--- a/libpcap/pcap-new.c
13+
+++ b/libpcap/pcap-new.c
14+
@@ -231,13 +231,21 @@ int pcap_findalldevs_ex(const char *source, struct pcap_rmtauth *auth, pcap_if_t
15+
#else
16+
/* opening the folder */
17+
unixdir= opendir(path);
18+
+ if (unixdir == NULL) {
19+
+ DIAG_OFF_FORMAT_TRUNCATION
20+
+ snprintf(errbuf, PCAP_ERRBUF_SIZE,
21+
+ "Error when listing files: does folder '%s' exist?", path);
22+
+ DIAG_ON_FORMAT_TRUNCATION
23+
+ return -1;
24+
+ }
25+
26+
/* get the first file into it */
27+
filedata= readdir(unixdir);
28+
29+
if (filedata == NULL)
30+
{
31+
- snprintf(errbuf, PCAP_ERRBUF_SIZE, "Error when listing files: does folder '%s' exist?", path);
32+
+ snprintf(errbuf, PCAP_ERRBUF_SIZE, "Error when listing files: does folder '%s' contain files?", path);
33+
+ closedir(unixdir);
34+
return -1;
35+
}
36+
#endif
37+
--
38+
2.34.1
39+

‎SPECS/nmap/nmap.spec‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Nmap Network Mapper
22
Name: nmap
33
Version: 7.93
4-
Release: 2%{?dist}
4+
Release: 3%{?dist}
55
License: Nmap
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -18,7 +18,9 @@ BuildRequires: make
1818
BuildRequires: openssl-devel
1919
BuildRequires: zlib-devel
2020

21-
Patch1: remove_openssl_macro.patch
21+
Patch0: remove_openssl_macro.patch
22+
Patch1: CVE-2023-7256.patch
23+
Patch2: CVE-2024-8006.patch
2224

2325
%description
2426
Nmap ("Network Mapper") is a free and open source utility for network discovery and security auditing.
@@ -59,6 +61,9 @@ ln -s ncat %{buildroot}%{_bindir}/nc
5961
%{_bindir}/nc
6062

6163
%changelog
64+
* Mon Nov 18 2024 Kavya Sree Kaitepalli <kkaitepalli@microsoft.com> - 7.93-3
65+
- Fix CVE-2023-7256 and CVE-2024-8006
66+
6267
* Wed Jan 17 2024 Harshit Gupta <guptaharshit@microsoft.com> - 7.93-2
6368
- Release bump with no changes to force a rebuild and consume new libssh2 build
6469

0 commit comments

Comments
 (0)