Vulnerability Title: Out-of-Bounds Write in L2TP / L2TPv6 Host Name AVP Parsing of D-Link DIR-895L

Discovered by: tzh00203

Contact Information: [email protected]

Affected Version: D-Link DIR-895L A1 firmware represented by the DIR895L_A1_GPL102b07DLink GPL package

Component: pppd.alpha l2tp and l2tp_ipv6

1. Vulnerability Overview

An out-of-bounds write vulnerability exists in the L2TP control channel parser of D-Link DIR-895L. When the device is configured to use L2TP or L2TPv6 WAN connectivity, a malicious upstream L2TP peer can send a crafted control packet containing a large Host Name AVP and trigger a one-byte write past the end of the peer_hostname buffer during tunnel setup.

The same bug pattern exists in both the IPv4 and IPv6 L2TP parser variants included in the GPL package.

2. Detailed Description

The vulnerable code is located in tunnel_set_params():

case AVP_HOST_NAME:
    if (len >= MAX_HOSTNAME) len = MAX_HOSTNAME-1;
    memcpy(tunnel->peer_hostname, val, len);
    tunnel->peer_hostname[len+1] = 0;
    d_dbg("l2tp: %s Peer host name is '%s'\n",
        l2tp_debug_tunnel_to_str(tunnel), tunnel->peer_hostname);
    break;

The destination buffer is defined as:

#define MAX_HOSTNAME 128
...
char peer_hostname[MAX_HOSTNAME];

The Host Name AVP is parsed from an incoming L2TP control datagram:

val = l2tp_dgram_pull_avp(dgram, tunnel, &mandatory, &hidden, &len,
    &vendor, &type, &err);

Although the code attempts to clamp the length to MAX_HOSTNAME - 1, it later writes the terminator at len + 1. If the effective Host Name length becomes 127, the parser writes to peer_hostname[128], which is outside the valid bounds of the buffer.

Root Cause