Skip to content

Commit a5e4135

Browse files
CBL-Mariner-BotKavyaSree2610
CBL-Mariner-Bot
and
KavyaSree2610
authored
[AUTO-CHERRYPICK] Fix CVE-2023-7256 and CVE-2024-8006 for nmap : 3.0 - branch 3.0-dev (#11191)
Co-authored-by: KavyaSree2610 <92566732+KavyaSree2610@users.noreply.github.com>
1 parent 0880420 commit a5e4135

3 files changed

Lines changed: 348 additions & 2 deletions

File tree

‎SPECS/nmap/CVE-2023-7256.patch‎

Lines changed: 301 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,301 @@
1+
From 3b1b155b6f1238a1f1bbc2cd37aee44f1c991f1e Mon Sep 17 00:00:00 2001
2+
From: kavyasree <kkaitepalli@microsoft.com>
3+
Date: Mon, 18 Nov 2024 09:54:44 +0530
4+
Subject: [PATCH] Fix CVE-2023-7256
5+
6+
---
7+
libpcap/pcap-rpcap.c | 48 ++++++++++++++++++-----------------
8+
libpcap/sockutils.c | 60 +++++++++++++++++++++++++-------------------
9+
libpcap/sockutils.h | 5 ++--
10+
3 files changed, 61 insertions(+), 52 deletions(-)
11+
12+
diff --git a/libpcap/pcap-rpcap.c b/libpcap/pcap-rpcap.c
13+
index 22fc736..cf912c9 100644
14+
--- a/libpcap/pcap-rpcap.c
15+
+++ b/libpcap/pcap-rpcap.c
16+
@@ -1021,7 +1021,6 @@ rpcap_remoteact_getsock(const char *host, int *error, char *errbuf)
17+
{
18+
struct activehosts *temp; /* temp var needed to scan the host list chain */
19+
struct addrinfo hints, *addrinfo, *ai_next; /* temp var needed to translate between hostname to its address */
20+
- int retval;
21+
22+
/* retrieve the network address corresponding to 'host' */
23+
addrinfo = NULL;
24+
@@ -1029,9 +1028,9 @@ rpcap_remoteact_getsock(const char *host, int *error, char *errbuf)
25+
hints.ai_family = PF_UNSPEC;
26+
hints.ai_socktype = SOCK_STREAM;
27+
28+
- retval = sock_initaddress(host, NULL, &hints, &addrinfo, errbuf,
29+
+ addrinfo = sock_initaddress(host, NULL, &hints, errbuf,
30+
PCAP_ERRBUF_SIZE);
31+
- if (retval != 0)
32+
+ if (addrinfo == NULL)
33+
{
34+
*error = 1;
35+
return NULL;
36+
@@ -1183,7 +1182,9 @@ static int pcap_startcapture_remote(pcap_t *fp)
37+
hints.ai_flags = AI_PASSIVE; /* Data connection is opened by the server toward the client */
38+
39+
/* Let's the server pick up a free network port for us */
40+
- if (sock_initaddress(NULL, NULL, &hints, &addrinfo, fp->errbuf, PCAP_ERRBUF_SIZE) == -1)
41+
+ addrinfo = sock_initaddress(NULL, NULL, &hints, fp->errbuf,
42+
+ PCAP_ERRBUF_SIZE);
43+
+ if (addrinfo == NULL)
44+
goto error_nodiscard;
45+
46+
if ((sockdata = sock_open(NULL, addrinfo, SOCKOPEN_SERVER,
47+
@@ -1308,7 +1309,9 @@ static int pcap_startcapture_remote(pcap_t *fp)
48+
snprintf(portstring, PCAP_BUF_SIZE, "%d", ntohs(startcapreply.portdata));
49+
50+
/* Let's the server pick up a free network port for us */
51+
- if (sock_initaddress(host, portstring, &hints, &addrinfo, fp->errbuf, PCAP_ERRBUF_SIZE) == -1)
52+
+ addrinfo = sock_initaddress(host, portstring, &hints,
53+
+ fp->errbuf, PCAP_ERRBUF_SIZE);
54+
+ if (addrinfo == NULL)
55+
goto error;
56+
57+
if ((sockdata = sock_open(host, addrinfo, SOCKOPEN_CLIENT, 0, fp->errbuf, PCAP_ERRBUF_SIZE)) == INVALID_SOCKET)
58+
@@ -2337,16 +2340,16 @@ rpcap_setup_session(const char *source, struct pcap_rmtauth *auth,
59+
if (port[0] == 0)
60+
{
61+
/* the user chose not to specify the port */
62+
- if (sock_initaddress(host, RPCAP_DEFAULT_NETPORT,
63+
- &hints, &addrinfo, errbuf, PCAP_ERRBUF_SIZE) == -1)
64+
- return -1;
65+
+ addrinfo = sock_initaddress(host, RPCAP_DEFAULT_NETPORT,
66+
+ &hints, errbuf, PCAP_ERRBUF_SIZE);
67+
}
68+
else
69+
{
70+
- if (sock_initaddress(host, port, &hints, &addrinfo,
71+
- errbuf, PCAP_ERRBUF_SIZE) == -1)
72+
- return -1;
73+
+ addrinfo = sock_initaddress(host, port, &hints,
74+
+ errbuf, PCAP_ERRBUF_SIZE);
75+
}
76+
+ if (addrinfo == NULL)
77+
+ return -1;
78+
79+
if ((*sockctrlp = sock_open(host, addrinfo, SOCKOPEN_CLIENT, 0,
80+
errbuf, PCAP_ERRBUF_SIZE)) == INVALID_SOCKET)
81+
@@ -2947,19 +2950,19 @@ SOCKET pcap_remoteact_accept_ex(const char *address, const char *port, const cha
82+
/* Do the work */
83+
if ((port == NULL) || (port[0] == 0))
84+
{
85+
- if (sock_initaddress(address, RPCAP_DEFAULT_NETPORT_ACTIVE, &hints, &addrinfo, errbuf, PCAP_ERRBUF_SIZE) == -1)
86+
- {
87+
- return (SOCKET)-2;
88+
- }
89+
+ addrinfo = sock_initaddress(address,
90+
+ RPCAP_DEFAULT_NETPORT_ACTIVE, &hints, errbuf,
91+
+ PCAP_ERRBUF_SIZE);
92+
}
93+
else
94+
{
95+
- if (sock_initaddress(address, port, &hints, &addrinfo, errbuf, PCAP_ERRBUF_SIZE) == -1)
96+
- {
97+
- return (SOCKET)-2;
98+
- }
99+
+ addrinfo = sock_initaddress(address, port, &hints, errbuf,
100+
+ PCAP_ERRBUF_SIZE);
101+
+ }
102+
+ if (addrinfo == NULL)
103+
+ {
104+
+ return (SOCKET)-2;
105+
}
106+
-
107+
108+
if ((sockmain = sock_open(NULL, addrinfo, SOCKOPEN_SERVER, 1, errbuf, PCAP_ERRBUF_SIZE)) == INVALID_SOCKET)
109+
{
110+
@@ -3119,7 +3122,6 @@ int pcap_remoteact_close(const char *host, char *errbuf)
111+
{
112+
struct activehosts *temp, *prev; /* temp var needed to scan the host list chain */
113+
struct addrinfo hints, *addrinfo, *ai_next; /* temp var needed to translate between hostname to its address */
114+
- int retval;
115+
116+
temp = activeHosts;
117+
prev = NULL;
118+
@@ -3130,9 +3132,9 @@ int pcap_remoteact_close(const char *host, char *errbuf)
119+
hints.ai_family = PF_UNSPEC;
120+
hints.ai_socktype = SOCK_STREAM;
121+
122+
- retval = sock_initaddress(host, NULL, &hints, &addrinfo, errbuf,
123+
+ addrinfo = sock_initaddress(host, NULL, &hints, errbuf,
124+
PCAP_ERRBUF_SIZE);
125+
- if (retval != 0)
126+
+ if (addrinfo == NULL)
127+
{
128+
return -1;
129+
}
130+
diff --git a/libpcap/sockutils.c b/libpcap/sockutils.c
131+
index 1c07f76..b66ed64 100644
132+
--- a/libpcap/sockutils.c
133+
+++ b/libpcap/sockutils.c
134+
@@ -1069,20 +1069,21 @@ get_gai_errstring(char *errbuf, int errbuflen, const char *prefix, int err,
135+
* \param errbuflen: length of the buffer that will contains the error. The error message cannot be
136+
* larger than 'errbuflen - 1' because the last char is reserved for the string terminator.
137+
*
138+
- * \return '0' if everything is fine, '-1' if some errors occurred. The error message is returned
139+
- * in the 'errbuf' variable. The addrinfo variable that has to be used in the following sockets calls is
140+
- * returned into the addrinfo parameter.
141+
+ * \return a pointer to the first element in a list of addrinfo structures
142+
+ * if everything is fine, NULL if some errors occurred. The error message
143+
+ * is returned in the 'errbuf' variable.
144+
*
145+
- * \warning The 'addrinfo' variable has to be deleted by the programmer by calling freeaddrinfo() when
146+
- * it is no longer needed.
147+
+ * \warning The list of addrinfo structures returned has to be deleted by
148+
+ * the programmer by calling freeaddrinfo() when it is no longer needed.
149+
*
150+
* \warning This function requires the 'hints' variable as parameter. The semantic of this variable is the same
151+
* of the one of the corresponding variable used into the standard getaddrinfo() socket function. We suggest
152+
* the programmer to look at that function in order to set the 'hints' variable appropriately.
153+
*/
154+
-int sock_initaddress(const char *host, const char *port,
155+
- struct addrinfo *hints, struct addrinfo **addrinfo, char *errbuf, int errbuflen)
156+
+struct addrinfo *sock_initaddress(const char *host, const char *port,
157+
+ struct addrinfo *hints, char *errbuf, int errbuflen)
158+
{
159+
+ struct addrinfo *addrinfo;
160+
int retval;
161+
162+
/*
163+
@@ -1094,9 +1095,13 @@ int sock_initaddress(const char *host, const char *port,
164+
* as those messages won't talk about a problem with the port if
165+
* no port was specified.
166+
*/
167+
- retval = getaddrinfo(host, port == NULL ? "0" : port, hints, addrinfo);
168+
+ retval = getaddrinfo(host, port == NULL ? "0" : port, hints, &addrinfo);
169+
if (retval != 0)
170+
{
171+
+ /*
172+
+ * That call failed.
173+
+ * Determine whether the problem is that the host is bad.
174+
+ */
175+
if (errbuf)
176+
{
177+
if (host != NULL && port != NULL) {
178+
@@ -1108,7 +1113,7 @@ int sock_initaddress(const char *host, const char *port,
179+
int try_retval;
180+
181+
try_retval = getaddrinfo(host, NULL, hints,
182+
- addrinfo);
183+
+ &addrinfo);
184+
if (try_retval == 0) {
185+
/*
186+
* Worked with just the host,
187+
@@ -1117,14 +1122,16 @@ int sock_initaddress(const char *host, const char *port,
188+
*
189+
* Free up the address info first.
190+
*/
191+
- freeaddrinfo(*addrinfo);
192+
+ freeaddrinfo(addrinfo);
193+
get_gai_errstring(errbuf, errbuflen,
194+
"", retval, NULL, port);
195+
} else {
196+
/*
197+
* Didn't work with just the host,
198+
* so assume the problem is
199+
- * with the host.
200+
+ * with the host; we assume
201+
+ * the original error indicates
202+
+ * the underlying problem.
203+
*/
204+
get_gai_errstring(errbuf, errbuflen,
205+
"", retval, host, NULL);
206+
@@ -1132,13 +1139,14 @@ int sock_initaddress(const char *host, const char *port,
207+
} else {
208+
/*
209+
* Either the host or port was null, so
210+
- * there's nothing to determine.
211+
+ * there's nothing to determine; report
212+
+ * the error from the original call.
213+
*/
214+
get_gai_errstring(errbuf, errbuflen, "",
215+
retval, host, port);
216+
}
217+
}
218+
- return -1;
219+
+ return NULL;
220+
}
221+
/*
222+
* \warning SOCKET: I should check all the accept() in order to bind to all addresses in case
223+
@@ -1153,30 +1161,28 @@ int sock_initaddress(const char *host, const char *port,
224+
* ignore all addresses that are neither? (What, no IPX
225+
* support? :-))
226+
*/
227+
- if (((*addrinfo)->ai_family != PF_INET) &&
228+
- ((*addrinfo)->ai_family != PF_INET6))
229+
+ if ((addrinfo->ai_family != PF_INET) &&
230+
+ (addrinfo->ai_family != PF_INET6))
231+
{
232+
if (errbuf)
233+
snprintf(errbuf, errbuflen, "getaddrinfo(): socket type not supported");
234+
- freeaddrinfo(*addrinfo);
235+
- *addrinfo = NULL;
236+
- return -1;
237+
+ freeaddrinfo(addrinfo);
238+
+ return NULL;
239+
}
240+
241+
/*
242+
* You can't do multicast (or broadcast) TCP.
243+
*/
244+
- if (((*addrinfo)->ai_socktype == SOCK_STREAM) &&
245+
- (sock_ismcastaddr((*addrinfo)->ai_addr) == 0))
246+
+ if ((addrinfo->ai_socktype == SOCK_STREAM) &&
247+
+ (sock_ismcastaddr(addrinfo->ai_addr) == 0))
248+
{
249+
if (errbuf)
250+
snprintf(errbuf, errbuflen, "getaddrinfo(): multicast addresses are not valid when using TCP streams");
251+
- freeaddrinfo(*addrinfo);
252+
- *addrinfo = NULL;
253+
- return -1;
254+
+ freeaddrinfo(addrinfo);
255+
+ return NULL;
256+
}
257+
258+
- return 0;
259+
+ return addrinfo;
260+
}
261+
262+
/*
263+
@@ -2082,7 +2088,6 @@ int sock_getascii_addrport(const struct sockaddr_storage *sockaddr, char *addres
264+
*/
265+
int sock_present2network(const char *address, struct sockaddr_storage *sockaddr, int addr_family, char *errbuf, int errbuflen)
266+
{
267+
- int retval;
268+
struct addrinfo *addrinfo;
269+
struct addrinfo hints;
270+
271+
@@ -2090,7 +2095,10 @@ int sock_present2network(const char *address, struct sockaddr_storage *sockaddr,
272+
273+
hints.ai_family = addr_family;
274+
275+
- if ((retval = sock_initaddress(address, "22222" /* fake port */, &hints, &addrinfo, errbuf, errbuflen)) == -1)
276+
+ if ((sock_initaddress(address, "22222" /* fake port */, &hints, &addrinfo, errbuf, errbuflen)) == -1)
277+
+ addrinfo = sock_initaddress(address, "22222" /* fake port */, &hints,
278+
+ errbuf, errbuflen);
279+
+ if (addrinfo == NULL)
280+
return 0;
281+
282+
if (addrinfo->ai_family == PF_INET)
283+
diff --git a/libpcap/sockutils.h b/libpcap/sockutils.h
284+
index a488d8f..30b8cfe 100644
285+
--- a/libpcap/sockutils.h
286+
+++ b/libpcap/sockutils.h
287+
@@ -138,9 +138,8 @@ void sock_fmterrmsg(char *errbuf, size_t errbuflen, int errcode,
288+
PCAP_FORMAT_STRING(const char *fmt), ...) PCAP_PRINTFLIKE(4, 5);
289+
void sock_geterrmsg(char *errbuf, size_t errbuflen,
290+
PCAP_FORMAT_STRING(const char *fmt), ...) PCAP_PRINTFLIKE(3, 4);
291+
-int sock_initaddress(const char *address, const char *port,
292+
- struct addrinfo *hints, struct addrinfo **addrinfo,
293+
- char *errbuf, int errbuflen);
294+
+struct addrinfo *sock_initaddress(const char *address, const char *port,
295+
+ struct addrinfo *hints, char *errbuf, int errbuflen);
296+
int sock_recv(SOCKET sock, SSL *, void *buffer, size_t size, int receiveall,
297+
char *errbuf, int errbuflen);
298+
int sock_recv_dgram(SOCKET sock, SSL *, void *buffer, size_t size,
299+
--
300+
2.34.1
301+

‎SPECS/nmap/CVE-2024-8006.patch‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
From 5021a8497e579cdc138565d60fa997d6bbbc00bc Mon Sep 17 00:00:00 2001
2+
From: kavyasree <kkaitepalli@microsoft.com>
3+
Date: Mon, 18 Nov 2024 05:47:26 +0530
4+
Subject: [PATCH] Fix CVE-2024-8006
5+
6+
---
7+
libpcap/pcap-new.c | 9 ++++++++-
8+
1 file changed, 8 insertions(+), 1 deletion(-)
9+
10+
diff --git a/libpcap/pcap-new.c b/libpcap/pcap-new.c
11+
index 76388a9..22bccb1 100644
12+
--- a/libpcap/pcap-new.c
13+
+++ b/libpcap/pcap-new.c
14+
@@ -232,6 +232,13 @@ int pcap_findalldevs_ex(const char *source, struct pcap_rmtauth *auth, pcap_if_t
15+
#else
16+
/* opening the folder */
17+
unixdir= opendir(path);
18+
+ if (unixdir == NULL) {
19+
+ DIAG_OFF_FORMAT_TRUNCATION
20+
+ snprintf(errbuf, PCAP_ERRBUF_SIZE,
21+
+ "Error when listing files: does folder '%s' exist?", path);
22+
+ DIAG_ON_FORMAT_TRUNCATION
23+
+ return -1;
24+
+ }
25+
26+
/* get the first file into it */
27+
filedata= readdir(unixdir);
28+
@@ -239,7 +246,7 @@ int pcap_findalldevs_ex(const char *source, struct pcap_rmtauth *auth, pcap_if_t
29+
if (filedata == NULL)
30+
{
31+
DIAG_OFF_FORMAT_TRUNCATION
32+
- snprintf(errbuf, PCAP_ERRBUF_SIZE, "Error when listing files: does folder '%s' exist?", path);
33+
+ snprintf(errbuf, PCAP_ERRBUF_SIZE, "Error when listing files: does folder '%s' contain files?", path);
34+
DIAG_ON_FORMAT_TRUNCATION
35+
closedir(unixdir);
36+
return -1;
37+
--
38+
2.34.1
39+

‎SPECS/nmap/nmap.spec‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Nmap Network Mapper
22
Name: nmap
33
Version: 7.95
4-
Release: 1%{?dist}
4+
Release: 2%{?dist}
55
License: Nmap
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -18,7 +18,9 @@ BuildRequires: make
1818
BuildRequires: openssl-devel
1919
BuildRequires: zlib-devel
2020

21-
Patch1: remove_openssl_macro.patch
21+
Patch0: remove_openssl_macro.patch
22+
Patch1: CVE-2024-8006.patch
23+
Patch2: CVE-2023-7256.patch
2224

2325
%description
2426
Nmap ("Network Mapper") is a free and open source utility for network discovery and security auditing.
@@ -63,6 +65,10 @@ ln -s ncat %{buildroot}%{_bindir}/nc
6365
%{_bindir}/nc
6466

6567
%changelog
68+
* Mon Nov 18 2024 Kavya Sree Kaitepalli <kkaitepalli@microsoft.com> - 7.95-2
69+
- Backport to fix CVE-2024-8006
70+
- Fix CVE-2023-7256.patch
71+
6672
* Fri Jul 05 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 7.95-1
6773
- Auto-upgrade to 7.95 to fix CVE-2022-33099
6874

0 commit comments

Comments
 (0)