!13 fix CVE-2024-5564

From: @XWwalker 
Reviewed-by: @jiangheng12 
Signed-off-by: @jiangheng12

backport-CVE-2024-5564.patch

@@ -0,0 +1,47 @@
+From 05e4ba7b0d126eea4c04387dcf40596059ee24af Mon Sep 17 00:00:00 2001
+From: Hangbin Liu <liuhangbin@gmail.com>
+Date: Wed, 5 Jun 2024 11:57:43 +0800
+Subject: [PATCH] libndp: valid route information option length
+
+RFC 4191 specifies that the Route Information Option Length should be 1, 2,
+or 3, depending on the Prefix Length. A malicious node could potentially
+trigger a buffer overflow and crash the tool by sending an IPv6 router
+advertisement message containing the "Route Information" option with a
+"Length" field larger than 3.
+
+To address this, add a check on the length field.
+
+Fixes: 8296a5bf0755 ("add support for Route Information Option (rfc4191)")
+Reported-by: Evgeny Vereshchagin <evverx@gmail.com>
+Suggested-by: Felix Maurer <fmaurer@redhat.com>
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Jiri Pirko <jiri@nvidia.com>
+
+Reference:https://github.com/jpirko/libndp/commit/05e4ba7b0d126eea4c04387dcf40596059ee24af
+Conflict:NA
+---
+ libndp/libndp.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/libndp/libndp.c b/libndp/libndp.c
+index 6314717..72ec92e 100644
+--- a/libndp/libndp.c
++++ b/libndp/libndp.c
+@@ -1231,6 +1231,17 @@ static bool ndp_msg_opt_route_check_valid(void *opt_data)
+ 	 */
+ 	if (((ri->nd_opt_ri_prf_reserved >> 3) & 3) == 2)
+ 		return false;
++
++	/* The Length field is 1, 2, or 3 depending on the Prefix Length.
++	 * If Prefix Length is greater than 64, then Length must be 3.
++	 * If Prefix Length is greater than 0, then Length must be 2 or 3.
++	 * If Prefix Length is zero, then Length must be 1, 2, or 3.
++	 */
++	if (ri->nd_opt_ri_len > 3 ||
++	    (ri->nd_opt_ri_prefix_len > 64 && ri->nd_opt_ri_len != 3) ||
++	    (ri->nd_opt_ri_prefix_len > 0 && ri->nd_opt_ri_len == 1))
++		return false;
++
+ 	return true;
+ }
+ 

libndp.spec

@@ -1,11 +1,16 @@
 Name:      libndp
-Version:   1.7
+Version:   1.8
 Release:   3
 Summary:   Library for Neighbor Discovery Protocol
 License:   LGPLv2+
 URL:       http://www.libndp.org/
 Source:    http://www.libndp.org/files/libndp-%{version}.tar.gz
 
+Patch0:        backport-CVE-2024-5564.patch
+
+BuildRequires: gcc
+BuildRequires: make
+
 %description
 This package contains a library which provides a wrapper
 for IPv6 Neighbor Discovery Protocol. It also provides a tool
@@ -35,8 +40,7 @@ Document files for libndp.
 %make_install
 %delete_la_and_a
 
-%post -p /sbin/ldconfig
-%postun -p /sbin/ldconfig
+%ldconfig_scriptlets
 
 %files
 %doc COPYING
@@ -52,5 +56,29 @@ Document files for libndp.
 %{_mandir}/man8/ndptool.8*
 
 %changelog
+* Tue Jun 11 2024 xingwei <xingwei14@h-partners.com> - 1.8-3
+- Type:CVE
+- ID:CVE-2024-5564
+- SUG:NA
+- DESC:fix CVE-2024-5564
+
+* Fri Oct 21 2022 gaihuiying <eaglegai@163.com> - 1.8-2
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:add make as BuildRequires for local rpmbuild
+
+* Sat Mar 19 2022 xihaochen<xihaochen@h-partners.com> - 1.8-1
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:update libndp version to 1.8
+
+* Thu May 27 2021 lijingyuan<lijingyuan3@huawei.com> - 1.7-4
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:Add the compilation dependency of gcc. 
+
 * Mon Sep 16 2019 liyongqiang<liyongqiang10@huawei.com> - 1.7-3
 - Package init

libndp.yaml

@@ -1,4 +1,4 @@
-version_concrol: github
+version_control: github
 src_repo: jpirko/libndp
 tag_prefix: v
 seperator: .