OpenWrt 19.07.1 update addressing a vulnerability allowing package substitution

Correction releases of the OpenWrt distribution have been published 18.06.7 and 19.07.1, which address a critical vulnerability (CVE-2020-7982) in the package manager opkg, allowing for a MITM attack and the replacement of content downloaded from the repository package. Due to a bug in the checksum verification code, an attacker can create conditions under which the SHA-256 checksums found in the digitally signed package index are ignored, allowing circumventing the integrity checking mechanisms of the downloaded ipk resources.

The problem has been present since February 2017, after adding code for ignoring leading whitespace before the checksum. Due to an error in skipping spaces, the pointer at the position in the string was not shifted, and the hex decoding loop for SHA-256 immediately returned control and returned a checksum of zero length.

Since the opkg package manager in OpenWrt runs with root privileges, if a MITM attack is organized, an attacker can stealthily make changes to the ipk package downloaded from the repository when the user runs the command "opkg install", and execute their code with root privileges by adding their own handler scripts invoked during installation to the package. To exploit the vulnerability, the attacker must also replace the valid and signed package index (for example, served from downloads.openwrt.org). The size of the modified package must match the original size specified in the index.

In a situation where it is necessary to avoid updating the entire firmware, only the opkg package manager can be updated by executing the following commands:

cd /tmp
opkg update
opkg download opkg
zcat ./opkg-lists/openwrt_base | grep -A10 "Package: opkg" | grep SHA256sum
sha256sum ./opkg_2020-01-25-c09fe209-1_*.ipk

Next, the displayed checksums should be compared, and if they match, execute:

opkg install ./opkg_2020-01-25-c09fe209-1_*.ipk

In the new versions, another vulnerability in the library libubox, which can lead to a buffer overflow when processing in the function blobmsg_format_json specially formatted serialized binary data or data in JSON format. The library is used in distribution components such as netifd, procd, ubus, rpcd, and uhttpd, as well as in the package auc (Attended sysUpgrade CLI). Buffer overflow occurs when passing large numeric attributes of type 'double' in blob blocks. To check the system's vulnerability, you can execute the command:

$ ubus call luci getFeatures \
'{ "banik": 00192200197600198000198100200400.1922 }'

In addition to addressing vulnerabilities and fixing accumulated bugs in the OpenWrt 19.07.1 release, the Linux kernel version has also been updated (from 4.14.162 to 4.14.167), and issues with performance when using 5GHz frequencies have been resolved, enabling support for Ubiquiti Rocket M Titanium, Netgear WN2500RP v1,
Zyxel NSA325, Netgear WNR3500 V2, Archer C6 v2, Ubiquiti EdgeRouter-X, Archer C20 v4, Archer C50 v4, Archer MR200, TL-WA801ND v5, HiWiFi HC5962, Xiaomi Mi Router 3 Pro, and Netgear R6350.

Source: opennet.ru