Vulnerability Title: Out-of-Bounds Write in L2TP Host Name AVP Parsing of D-Link DIR-605

Discovered by: tzh00203

Contact Information: [email protected]

Affected Version: D-Link DIR-605 B firmware represented by the WRGN22_DLWBR_DIR605B.v2.00 GPL package (the exact public firmware string should be confirmed on the test image before submission)

Component: pppd.alpha L2TP client / control channel parser

1. Vulnerability Overview

An out-of-bounds write vulnerability exists in the L2TP control message parser of D-Link DIR-605. When the device is configured to use L2TP WAN connectivity, a malicious L2TP server or an attacker able to spoof or intercept the L2TP peer can send a crafted control packet containing an oversized Host Name AVP and trigger memory corruption in the tunnel setup logic.

The vulnerability is caused by an off-by-one write when the code copies a length-delimited Host Name AVP into a fixed-size peer_hostname buffer and then places the terminating NUL byte at len + 1 instead of len.

2. Detailed Description

The vulnerable code is located in tunnel_set_params():

case AVP_HOST_NAME:
    if (len >= MAX_HOSTNAME) len = MAX_HOSTNAME-1;
    memcpy(tunnel->peer_hostname, val, len);
    tunnel->peer_hostname[len+1] = 0;
    d_dbg("l2tp: %s Peer host name is '%s'\n",
        l2tp_debug_tunnel_to_str(tunnel), tunnel->peer_hostname);
    break;

The destination buffer is defined as:

#define MAX_HOSTNAME 128
...
char peer_hostname[MAX_HOSTNAME];

The Host Name AVP is parsed from an incoming L2TP control datagram in tunnel_set_params():

val = l2tp_dgram_pull_avp(dgram, tunnel, &mandatory, &hidden, &len,
    &vendor, &type, &err);

Although the code attempts to clamp the AVP length:

if (len >= MAX_HOSTNAME) len = MAX_HOSTNAME-1;

it then writes the terminator one byte too far: