[V4.3.4] Fix Buffer Over-read (CWE-126), Null Pointer Dereference (CWE-476) and Invalid Pointer Dereference (CWE-822)

[tony-josi-aws]

Description

Buffer Over-read (CWE-126):
The current implementation lacks sufficient checks to ensure that received packets meet the minimum size requirements for the following ICMPv6 message types:

1. ipICMP_PING_REPLY_IPv6
2. ipICMP_NEIGHBOR_ADVERTISEMENT_IPv6

This can lead to out-of-bounds read operations when processing packets smaller than the expected size.

This change adds validation checks to ensure that all received ICMPv6 packets meet the minimum size requirements for their respective message types.

Buffer Over-read (CWE-126):
The current implementation fails to validate the payload length field in the IPv6 packet header. This allows malicious packets with incorrect payload lengths to cause integer wraparound, resulting in erroneously large calculated payload length. This inflated payload length bypasses the existing bounds-checking mechanisms, leading to out-of-bounds read operations.

This change adds checks to validate the payload length field in the IPv6 packet header.

Null Pointer Dereference (CWE-476):
When a device receives an incoming IPv6 multicast packet that requires a response, the network stack attempts to find a link-local endpoint to handle the packet. If the device is not configured with a link-local endpoint, the pxFindLocalEndpoint function returns a NULL pointer, which leads to a subsequent NULL pointer dereference attempt.

This change adds a NULL pointer check before attempting to dereference the link-local endpoint.

Invalid Pointer Dereference (CWE-822):
When a device receives a UDP/IPv6 packet with ipconfigDRIVER_INCLUDED_RX_IP_CHECKSUM disabled, the IP version field is not validated, allowing the processing of packets with incorrect IP version field instead of rejecting them early. Subsequent attempts to extract network buffers from these invalid UDP packets can result in dereferencing of an invalid pointer due to incorrect pointer arithmetic, potentially leading to system crashes or undefined behavior.

This change adds validation checks for the IP version field in IPv6 packets, regardless of whether the config option ipconfigDRIVER_INCLUDED_RX_IP_CHECKSUM is enabled or disabled.

We would like to thank Ivan Gotovchits of Mayhem Security for collaborating on this issue through the coordinated vulnerability disclosure process.

Test Steps

Validated locally.

Checklist:

• I have tested my changes. No regression in existing tests.
• I have modified and/or added unit-tests to cover the code changes in this Pull Request.

Related Issue

NA.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.