lldpd:Device hangs after running LLDP suite in Defensics fuzz tool#420
lldpd:Device hangs after running LLDP suite in Defensics fuzz tool#420sudhanshukumar22 wants to merge 1 commit intolldpd:masterfrom
Conversation
…etrieve it back is by power cycling the device. As the device hangs and there is no access to Console/Mgmt Sessions, not able to take tech-support output in problem state. Attaching the pcap files of LLDP packets from Defensics server, as the report doesn't contain any failures. Also attaching the syslog output before/at the time hitting problem state. Additionally, I checked if there are any sporadic CPU/Memory hike while running and did not notice any. Only once seen lldp crash and attaching the same as well. Fix: added a validation check in MED processing in lldp_decode(). Signed-off-by: sudhanshukumar22 <sudhanshu.kumar@broadcom.com>
|
Thanks for your patch. However, it only works when the location is a civic address. The two other possibilities (coordinate and ELIN) does use the first byte as a length. In |
I am attaching the lldp packet capture: Please ignore the name. |
|
Thanks, I am running into a bit of trouble to run some tests. Hopefully, this will be solved next week. |
Some bounds were not checked correctly when parsing LLDP-MED civic location fields. This triggers out-of-bound reads (no write) in lldpcli, ultimately leading to a crash. Fix #420
|
If you can run again the test suite, it will be helpful to catch remaining bugs! |
|
@vincentbernat : Does your pull request 422 fix this issue ? |
|
Yes, it should. I was able to reproduce your issue. |
The details are as follows:
1. 0010-Ported-fix-for-length-exceeded-from-lldp-community.patch
Patch taken from lldpd/lldpd@7824347
lib: remove limit on system description length
The limit was introduced in 9c49ced while fixing a memory leak.
The state data is used to ensure we don't interleave operations. We
need to handle the case where the value is truncated because it is
larger than the allocated size.
Fix issue lldpd/lldpd#408
2. 0011-fix-med-location-len.patch
Patch taken from lldpd/lldpd@5c34794
lib: fix LLDP-MED location parsing in liblldpctl
Some bounds were not checked correctly when parsing LLDP-MED civic
location fields. This triggers out-of-bound reads (no write) in
lldpcli, ultimately leading to a crash.
Fix lldpd/lldpd#420
Signed-off-by: sudhanshukumar22 <sudhanshu.kumar@broadcom.com>
The details are as follows:
1. 0010-Ported-fix-for-length-exceeded-from-lldp-community.patch
Patch taken from lldpd/lldpd@7824347
lib: remove limit on system description length
The limit was introduced in 9c49ced while fixing a memory leak.
The state data is used to ensure we don't interleave operations. We
need to handle the case where the value is truncated because it is
larger than the allocated size.
Fix issue lldpd/lldpd#408
2. 0011-fix-med-location-len.patch
Patch taken from lldpd/lldpd@5c34794
lib: fix LLDP-MED location parsing in liblldpctl
Some bounds were not checked correctly when parsing LLDP-MED civic
location fields. This triggers out-of-bound reads (no write) in
lldpcli, ultimately leading to a crash.
Fix lldpd/lldpd#420
Signed-off-by: sudhanshukumar22 <sudhanshu.kumar@broadcom.com>
Running Defensics LLDP suite often hangs the device and only way to retrieve it back is by power cycling the device.
As the device hangs and there is no access to Console/Mgmt Sessions, not able to take tech-support output in problem state.
Attaching the pcap files of LLDP packets from Defensics server, as the report doesn't contain any failures.
Also attaching the syslog output before/at the time hitting problem state.
Additionally, I checked if there are any sporadic CPU/Memory hike while running and did not notice any.
Only once seen lldp crash and attaching the same as well.
Fix: added a validation check in MED processing in lldp_decode().
Signed-off-by: sudhanshukumar22 sudhanshu.kumar@broadcom.com