#70 report an another vulnerability

[chennan]

Hello,
I find an another memory corruption vulnerability in l2tp protocol.
The vulnerability is in the 'ppp_l2tp_avp_list2ptrs' function of the l2tp_avp.c file, which has the following code:

case AVP_CAUSE_CODE:
    AVP_ALLOC(causecode);
    ptrs->causecode->causecode = ntohs(ptr16[0]);
    ptrs->causecode->causemsg = ptr8[3];
    memcpy(ptrs->causecode->message,
        (char *)avp->value + 3, avp->vlen - 3);
    break;

There is no check here whether 'avp->vlen' is less than 3. This will lead to OOW.

[Eugene Grosbein]

Thank you for the report. The issue is being investigated, please wait.

[Eugene Grosbein]

Thank you very much for your patience. The problem is confirmed and fixed. New version 5.9 containing the fix is released.

[chennan]

May I apply for a CVE number?

[Eugene Grosbein]

Sure.

[Xin LI]

We (FreeBSD security team) have assigned CVE-2020-7465 for this one (I'm posting this here mainly to avoid duplicated allocations).

[chennan]

Thank you very much.
Discoverer(s): ChenNan Of Chaitin Security Research Lab