Repository navigation
Conversation
The Linux DNS restore path in resetDNS (cmd/cli/os_linux.go) builds a default nclient4 client with nclient4.New and calls Request to re-read the DHCP-provided nameservers. A default client receives replies through BroadcastRawUDPConn.ReadFrom, which before insomniacslk/dhcp#583 subtracted the 8-byte UDP header length from the IPv4 payload length without first checking the payload was that long. A reply whose IPv4 payload declared fewer than 8 bytes gave a negative slice bound and panicked, so a malformed DHCP reply on the link could crash the restore path. Bump the pin from v0.0.0-20231206064809-8c70d406f6d2 to v0.0.0-20260719225207-c76316d4aa82, which carries the fix. The guarded ReadFrom now discards frames whose IPv4 payload is shorter than the UDP header instead of computing a negative length. go build ./... passes and the cmd/cli test package still compiles. Only go.mod and go.sum change. Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>
8e031a5 to
60b117e
Compare
thc1006
changed the title
|
Thanks for contributing. This will be included in next ctrld release. |
|
This didn't make v1.5.6 or v1.5.7, and main is still on the 2023-12 pin. The macOS check went red inside |
It's in v1.0 branch: https://github.com/Control-D-Inc/ctrld/tree/v1.0 The main branch is for our new |
|
Thanks for the pointer, and sorry for the noise. I was reading main's go.mod, so I had that wrong: v1.5.6 and v1.5.7 both carry c76316d already. Glad it's in. |
2 participants
ctrld's Linux DNS restore path re-reads the DHCP nameservers with a default nclient4 client.
resetDNSincmd/cli/os_linux.gocallsnclient4.New(iface.Name)thenc.Request(ctx), with noWithUnicast, so replies come back throughBroadcastRawUDPConn.ReadFrom.Before insomniacslk/dhcp#583,
ReadFromsubtracted the 8-byte UDP header from the IPv4 payload length without checking the payload was that long, so a reply declaring fewer than 8 bytes gave a negative slice bound and panicked, which could crash the restore path. I wrote the fix; it drops frames whose IPv4 payload is shorter than the UDP header instead of computing a negative length.This bumps the pin from
v0.0.0-20231206064809-8c70d406f6d2(2023-12) to the #583 merge commit. Only go.mod and go.sum change;go build ./...passes andgo vet ./cmd/cli/is clean. No CVE, and I haven't tried to reproduce a crash inside ctrld.