mirror of
http://thekelleys.org.uk/git/dnsmasq.git
synced 2026-10-20 11:29:35 +00:00
Dominik
9dec84ca42
rand64() declared its own `static int outleft`, shadowing the global one while all three functions share the same out[] SURF output buffer. When rand64() called surf() to refill out[], the global outleft still indexed into the now-overwritten buffer, so subsequent rand32() or rand16() calls could return the same words rand64() had already consumed. Drop the local static so all three functions coordinate through the same counter. Security: rand64() is used to generate DHCPv6 temporary address interface IDs, which are visible on the local network. Because of the shared buffer issue, an observer could reconstruct the out[] words consumed by rand64() and predict the next rand32() outputs. rand32() drives the 0x20 case-scrambling bitmap used to harden DNS queries against cache-poisoning, so this leaks PRNG state across the DHCPv6 and DNS code paths. I'd still say the overall severity is rather low as local network access required, and 0x20 encoding is really a defence-in-depth and not some kind of essential security. Signed-off-by: Dominik <dl6er@dl6er.de>