Re: [PATCH v1] NetworkPkg/DnsDxe: Check the received packet size before parsing the message.

["Wu, Jiaxin" <jiaxin.wu@intel.com>]

Thanks Laszlo, I  will update the subject to include the CVE number when commit the patch.


> -----Original Message-----
> From: Laszlo Ersek [mailto:lersek@redhat.com]
> Sent: Tuesday, February 26, 2019 7:17 PM
> To: Wu, Jiaxin <jiaxin.wu@intel.com>; edk2-devel@lists.01.org
> Cc: Ye, Ting <ting.ye@intel.com>; Wang, Fan <fan.wang@intel.com>; Fu, Siyuan
> <siyuan.fu@intel.com>
> Subject: Re: [edk2] [PATCH v1] NetworkPkg/DnsDxe: Check the received packet
> size before parsing the message.
> 
> On 02/26/19 09:14, Jiaxin Wu wrote:
> > Fix CVE-2018-12178
> > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=809
> >
> > The DNS driver only checks the received packet size against the
> > minimum DNS header size in DnsOnPacketReceived(), later it accesses
> > the QueryName and QuerySection beyond the header scope, which might
> > cause the pointer within DNS driver points to an invalid entry or
> > modifies the memory content beyond the header scope.
> >
> > This patch is to fix above problem.
> >
> > Cc: Ye Ting <ting.ye@intel.com>
> > Cc: Fu Siyuan <siyuan.fu@intel.com>
> > Cc: Wang Fan <fan.wang@intel.com>
> > Contributed-under: TianoCore Contribution Agreement 1.0
> > Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
> > ---
> >  NetworkPkg/DnsDxe/DnsImpl.c | 77 ++++++++++++++++++++++++++++++++--
> ---
> >  NetworkPkg/DnsDxe/DnsImpl.h |  2 +
> >  2 files changed, 69 insertions(+), 10 deletions(-)
> 
> Please put the precise CVE number in the subject line.
> 
> Laszlo