Vulnerability Title: Out-of-Bounds Write in rp-l2tp Host Name AVP Parsing of D-Link DIR-825
Discovered by: tzh00203
Contact Information: [email protected]
Affected Version: D-Link DIR-825 C1 firmware represented by the DIR-825_C1-GPL source package (the exact public firmware image label should be confirmed on the tested device before submission)
Component: rp-l2tp
An out-of-bounds write vulnerability exists in the rp-l2tp component of D-Link DIR-825. When the device is configured to use L2TP WAN connectivity, a malicious L2TP server or an attacker able to spoof or intercept the remote peer can send a crafted control message containing a large Host Name AVP and trigger memory corruption during tunnel setup.
The issue is caused by off-by-one termination logic after copying a length-delimited Host Name AVP into a fixed-size peer_hostname buffer.
The vulnerable code is in tunnel_set_params():
val = l2tp_dgram_search_avp(dgram, tunnel, &mandatory, &hidden, &len,
VENDOR_IETF, AVP_HOST_NAME);
...
if (len >= MAX_HOSTNAME) len = MAX_HOSTNAME-1;
memcpy(tunnel->peer_hostname, val, len);
tunnel->peer_hostname[len+1] = 0;
The destination buffer is:
#define MAX_HOSTNAME 128
...
char peer_hostname[MAX_HOSTNAME];
The function comment explicitly states that it processes an incoming SCCRQ or SCCRP datagram:
* dgram -- incoming SCCRQ or SCCRP datagram
This means a malicious upstream peer can directly influence the Host Name AVP parsed by the function.
When the Host Name AVP length is 127 bytes or more, the code clamps len to 127, copies 127 bytes into peer_hostname, and then writes the terminator to peer_hostname[128], which is one byte outside the valid buffer.