Repository navigation
tlv_dcbx: bounds-check nested TLVs in legacy DCBX decoders - #136
Open
DicksonWu654 wants to merge 1 commit into
Open
DicksonWu654 wants to merge 1 commit into
DicksonWu654 wants to merge 1 commit into
Conversation
unpack_dcbx1_tlvs and unpack_dcbx2_tlvs walk the nested TLVs inside a received legacy DCBX TLV without checking the nested header and length against what is left of the outer TLV, so a short or inconsistent LLDPDU from a link peer makes them read past the TLV buffer. Reject the frame when the outer TLV is shorter than OUI plus subtype, when fewer than 2 bytes remain for a nested header, when a nested length runs past the outer TLV, and when an application or logical link TLV is too short to hold its subtype byte. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to my email to Aaron and Loren. The legacy DCBX decoders (
unpack_dcbx1_tlvs/unpack_dcbx2_tlvs) don't check nested TLV lengths against the outer TLV, so a malformed LLDPDU from a link peer reads past the TLV buffer (ASan heap-buffer-overflow READ of 1, 2 and up to 408 bytes). This adds the missing bounds checks and drops the frame instead.Testing: a small harness drives one LLDPDU per case through
rxProcessFramewith the realrx.c,agent.c,lldp_dcbx.c,tlv_dcbx.candlldp_tlv.c. Unpatched, ASan reports the over-read; patched, each frame setsbadFrameand is discarded.make checkpasses on the patched tree. I didn't see over-read bytes leave the daemon, so this is a robustness fix.Disclosure: I found this with LLM-assisted analysis and the patch was LLM-generated. I reran the tests above on current master before opening this.
🤖 Generated with Claude Code