New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 862112 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Jul 13
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug-Security



Sign in to add a comment

CrOS: Vulnerability reported in net-vpn/strongswan: CVE-2018-5388

Project Member Reported by vomit.go...@appspot.gserviceaccount.com, Jul 10

Issue description

Automated analysis has detected that the following third party packages have had vulnerabilities publicly reported. 

NOTE: There may be several bugs listed below - in almost all cases, all bugs can be quickly addressed by upgrading to the latest version of the package.

Package Name: net-vpn/strongswan
Package Version: [cpe:/a:strongswan:strongswan:5.5.3]

Advisory: CVE-2018-5388
  Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2018-5388
  CVSS severity score: 4/10.0
  Confidence: high
  Description:

In stroke_socket.c in strongSwan before 5.6.3, a missing packet length check could allow a buffer underflow, which may lead to resource exhaustion and denial of service while reading from the socket.


 
Cc: mortonm@chromium.org briannorris@chromium.org kirtika@chromium.org
Components: OS>Systems>Network
Owner: mortonm@chromium.org
Summary: CrOS: Vulnerability reported in net-vpn/strongswan: CVE-2018-5388 (was: CrOS: Vulnerability reported in net-vpn/strongswan)
So it looks like this bug was just recently discovered and only the current release of strongSwan (5.6.3) has the fix. Do we always just uprev to the most recent fixed version in this scenario or is it also a viable option to patch the affected code? Not sure if there are stability concerns with the bleeding-edge version
Project Member

Comment 3 by sheriffbot@chromium.org, Jul 10

Status: Assigned (was: Untriaged)
we leave it to the maintainers to make the call.  usually we'll uprev if it's not a package we track and they tend to be stable, but if we're patching strongswan quite a bit and upgrades aren't trivial, backporting the patch is reasonable.  especially since it sounds like this particular fix is simple.
briannorris@, kirtika@: I'm deferring to you folks on this one, although I've been working with some strongSwan patches in the recent past so let me know if you'd like me to see if I can backport this.
Cc: benchan@chromium.org
I know very little about strongswan. This patch looks extremely trivial to backport, so maybe that's easier.

BTW, I don't even see a 5.6.3 ebuild in Gentoo yet. That makes it slightly more difficult to upgrade.
A simple cherry-pick of the upstream patch on top of 5.5.3 should be sufficient for this case:

https://chromium-review.googlesource.com/c/chromiumos/overlays/chromiumos-overlay/+/1133596
Project Member

Comment 8 by bugdroid1@chromium.org, Jul 12

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/47a38321536da5b80636fa7878649569b1069e06

commit 47a38321536da5b80636fa7878649569b1069e06
Author: Ben Chan <benchan@chromium.org>
Date: Thu Jul 12 09:33:21 2018

net-vpn/strongswan: verify message length in stroke plugin

This CL cherry-picks the following upstream patch to strongswan 5.5.3:

  commit 0acd1ab4d08d53d80393b1a37b8781f6e7b2b996
  Author: Tobias Brunner <tobias@strongswan.org>
  Date:   Tue Mar 13 18:54:08 2018 +0100

      stroke: Ensure a minimum message length

BUG= chromium:862112 
TEST=`emerge-$BOARD strongswan`
TEST=Run network_VPNConnect.l2tpipsec_* tests

Change-Id: Ia25878a6d3ca83d1fb99b03ff392050e3e06f066
Reviewed-on: https://chromium-review.googlesource.com/1133596
Commit-Ready: Ben Chan <benchan@chromium.org>
Tested-by: Ben Chan <benchan@chromium.org>
Reviewed-by: Ben Chan <benchan@chromium.org>

[add] https://crrev.com/47a38321536da5b80636fa7878649569b1069e06/net-vpn/strongswan/files/strongswan-5.5.3-stroke-Ensure-a-minimum-message-length.patch
[rename] https://crrev.com/47a38321536da5b80636fa7878649569b1069e06/net-vpn/strongswan/strongswan-5.5.3-r8.ebuild
[modify] https://crrev.com/47a38321536da5b80636fa7878649569b1069e06/net-vpn/strongswan/strongswan-5.5.3.ebuild

Status: Fixed (was: Assigned)
the cherry pick should fix this
Project Member

Comment 10 by sheriffbot@chromium.org, Jul 14

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 11 by sheriffbot@chromium.org, Oct 20

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment