Heap overflow vulnerabilities in network implementation of barebox

[jianqiang wang <wjq.sec@gmail.com>]

Dear Barebox devlopers,

I found several heap overflow vulnerabilities in Barebox.

The Barebox implementation assumes that the network packet received is
less than PKTSIZE, that is 1536 bytes. For example, the /net/net.c
file ping_reply function assumes that the packet received is 1536
bytes and allocates a 1536 bytes buffer then copies the packet data
into the buffer.

However, in the driver layer, it lacks a proper check of the packet length.
For example, in drivers/net/cs8900.c cs8900_probe function, it
allocates a PKTSIZE buffer and assigns it to rx_buf. In cs8900_recv
function, the length is read from the device register:

len = readw(priv->regs + CS8900_RTDATA0);

After that, the data is read from the register in a loop without a
boundary check.
The same vulnerability happens to the following drivers:

drivers/net/ks8851_mll.c function ks8851_rx_frame, it only and the
packet length with RXFHBCR_CNT_MASK (4095 bytes,) which is not
consistent with the upper layer length check.

drivers/net/liteeth.c function liteeth_eth_rx, It checks if the length
is larger than 2048 which is inconsistent with the upper layer.

drivers/net/smc911x.c function smc911x_eth_rx. The packet length is
read from the register without checking.

It would be good to add a proper and consistent boundary check for
these drivers otherwise it will lead to potential heap overflow
vulnerability.

Best regards