Synopsis
While researching CVE-2017-12240, Tenable found multiple vulnerabilities in the Cisco IOS/XE DHCP relay agent.
Introduction to the IOS/XE DHCP Relay Agent
A DHCP relay agent forwards messages between DHCP clients and servers. The IOS/XE relay agent can be configured to add an additional DHCP option to client requests. The additional option, DHCP option 82, is intended to prevent untrusted clients from sending DHCP requests.
CVE-2018-0172: Heap Buffer Overflow
When an IOS/XE relay agent receives a DHCP request containing a DHCP option 82 the agent will generate a new option 82 and encapsulate the original in a suboption. The agent moves the original option 82 and any proceeding data with memmove before placing the new option 82 in the cleared out space. If the client provided option 82 is located at the very end of a heap block then the memmove will overflow into the next block.
To exploit this an attacker can send an 0x2000 byte DHCP discover message with an option 82 at the very end.
CVE-2018-0174: Bad Pointer Arithmetic #1
As mentioned above, the relay agent will memmove the client provided option 82 in order to encapsulate it. To determine the size of the memmove the agent calculates pEndOfMsg - pEndOfEncapsulatedOpt82. The problem is that pEndOfEncapsulatedOpt82 can be greater than pEndOfMsg. The result is that the agent attempts to memmove a very large amount of data which eventually triggers an access violation.
CVE-2018-0173: Bad Pointer Arithmetic #2
When the relay agent receives a DHCP offer from the server it will remove the agent added option 82 before forwarding the offer to the client. To remove the option 82, the agent uses memset on the memory before and after the original client provided option 82. The agent assumes that the agent added option 82 will encapsulate the original client option 82 entirely. However, if the client provided an option 82 with an invalid length (ie. too long) then the size of the client provided option 82 will exceed the size of the agent added option 82. Therefore, when the agent calculates the size of after to memset it will compute a very large number which leads to an access violation.
Solution
Cisco has released updates. Follow their advisory to appropriately identify the vulnerable systems and update.Additional References
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr1https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr2
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr3
Disclosure Timeline
All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.
Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.
For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.
If you have questions or corrections about this advisory, please email [email protected]
Contact our sales team