Vulnerability Title: Out-of-Bounds Write in L2TP / L2TPv6 Host Name AVP Parsing of D-Link DIR-822A

Discovered by: tzh00203

Contact Information: [email protected]

Affected Version: D-Link DIR-822A firmware represented by the DIR822A1_GPL103WWb03 GPL package (the exact public firmware string should be confirmed on the test image before submission)

Component: pppd.alpha l2tp and l2tp_ipv6

1. Vulnerability Overview

An out-of-bounds write vulnerability exists in the L2TP control message parser of D-Link DIR-822A. When the device is configured to use L2TP or L2TPv6 WAN connectivity, a malicious upstream L2TP server or an attacker able to spoof or intercept the remote peer can send a crafted control packet containing an oversized Host Name AVP and trigger memory corruption during tunnel setup.

The bug affects both the IPv4 and IPv6 L2TP parser variants shipped in the DIR-822A GPL source tree.

2. Detailed Description

The vulnerable logic appears in tunnel_set_params() and is identical in both l2tp and l2tp_ipv6:

case AVP_HOST_NAME:
    if (len >= MAX_HOSTNAME) len = MAX_HOSTNAME-1;
    memcpy(tunnel->peer_hostname, val, len);
    tunnel->peer_hostname[len+1] = 0;
    d_dbg("l2tp: %s Peer host name is '%s'\n",
        l2tp_debug_tunnel_to_str(tunnel), tunnel->peer_hostname);
    break;

The destination buffer is defined as:

#define MAX_HOSTNAME 128
...
char peer_hostname[MAX_HOSTNAME];

The Host Name AVP is obtained from an incoming L2TP control datagram inside tunnel_set_params():

val = l2tp_dgram_pull_avp(dgram, tunnel, &mandatory, &hidden, &len,
    &vendor, &type, &err);

The code clamps the AVP length to 127, but then places the NUL terminator at len + 1. When len == 127, the parser writes to peer_hostname[128], causing a one-byte out-of-bounds write.

Root Cause