denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

libsimaka: Reject zero-length EAP-SIM/AKA attributes

Browse Source 
parse_attributes() accepts hdr->length == 0 in the AT_ENCR_DATA,
AT_RAND, AT_PADDING, default branches. The code then subtracts the
fixed attribute header size from the encoded length, which underflows
and exposes a wrapped payload length to later code.  In particular,
for the cases where add_attribute() is called, this causes a heap-based
buffer overflow (a buffer of 12 bytes is allocated to which the wrapped
length is written).  For AT_PADDING, the underflow is irrelevant as
add_attribute() is not called. Instead, this results in an infinite loop.

Reject zero-length attributes before subtracting the attribute header.

Signed-off-by: Lukas Johannes Möller <research@johannes-moeller.dev>

Fixes: f8330d0395 ("Added a libsimaka library with shared message handling code for EAP-SIM/AKA")
Fixes: CVE-2026-35330
This commit is contained in:
Lukas Johannes Möller
2026-04-21 16:48:56 +02:00
committed by Tobias Brunner
parent 19d73ef156
commit aa5aaebc33
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libsimaka/simaka_message.c
+2 -3
View File
@@ -416,7 +416,7 @@ static bool parse_attributes(private_simaka_message_t *this, chunk_t in)
case AT_ENCR_DATA:
case AT_RAND:
{
if (hdr->length * 4 > in.len || in.len < 4)
if (hdr->length == 0 || hdr->length * 4 > in.len || in.len < 4)
{
return invalid_length(hdr->type);
}
@@ -439,7 +439,7 @@ static bool parse_attributes(private_simaka_message_t *this, chunk_t in)
case AT_PADDING:
default:
{
if (hdr->length * 4 > in.len || in.len < 4)
if (hdr->length == 0 || hdr->length * 4 > in.len || in.len < 4)
{
return invalid_length(hdr->type);
}
@@ -932,4 +932,3 @@ simaka_message_t *simaka_message_create(bool request, uint8_t identifier,
return simaka_message_create_data(chunk_create((char*)&hdr, sizeof(hdr)),
crypto);
}