[R1] Cisco IOS and IOS XE Multiple Memory Corruption Vulnerabilities

While researching CVE-2017-12240, Tenable found multiple vulnerabilities in the Cisco IOS/XE DHCP relay agent.

Introduction to the IOS/XE DHCP Relay Agent

A DHCP relay agent forwards messages between DHCP clients and servers. The IOS/XE relay agent can be configured to add an additional DHCP option to client requests. The additional option, DHCP option 82, is intended to prevent untrusted clients from sending DHCP requests.

CVE-2018-0172: Heap Buffer Overflow

When an IOS/XE relay agent receives a DHCP request containing a DHCP option 82 the agent will generate a new option 82 and encapsulate the original in a suboption. The agent moves the original option 82 and any proceeding data with memmove before placing the new option 82 in the cleared out space. If the client provided option 82 is located at the very end of a heap block then the memmove will overflow into the next block.

To exploit this an attacker can send an 0x2000 byte DHCP discover message with an option 82 at the very end.

CVE-2018-0174: Bad Pointer Arithmetic #1

As mentioned above, the relay agent will memmove the client provided option 82 in order to encapsulate it. To determine the size of the memmove the agent calculates pEndOfMsg - pEndOfEncapsulatedOpt82. The problem is that pEndOfEncapsulatedOpt82 can be greater than pEndOfMsg. The result is that the agent attempts to memmove a very large amount of data which eventually triggers an access violation.

CVE-2018-0173: Bad Pointer Arithmetic #2

When the relay agent receives a DHCP offer from the server it will remove the agent added option 82 before forwarding the offer to the client. To remove the option 82, the agent uses memset on the memory before and after the original client provided option 82. The agent assumes that the agent added option 82 will encapsulate the original client option 82 entirely. However, if the client provided an option 82 with an invalid length (ie. too long) then the size of the client provided option 82 will exceed the size of the agent added option 82. Therefore, when the agent calculates the size of after to memset it will compute a very large number which leads to an access violation.