CVE-2022-23218: Buffer overflow in sunrpc svcunix_create (bug 28768)
The sunrpc function svcunix_create suffers from a stack-based buffer overflow with overlong pathname arguments. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
This commit is contained in:
parent
ef972a4c50
commit
f545ad4928
3
NEWS
3
NEWS
|
@ -160,6 +160,9 @@ Security related changes:
|
||||||
legacy function could result in a stack-based buffer overflow when
|
legacy function could result in a stack-based buffer overflow when
|
||||||
using the "unix" protocol. Reported by Martin Sebor.
|
using the "unix" protocol. Reported by Martin Sebor.
|
||||||
|
|
||||||
|
CVE-2022-23218: Passing an overlong file name to the svcunix_create
|
||||||
|
legacy function could result in a stack-based buffer overflow.
|
||||||
|
|
||||||
The following bugs are resolved with this release:
|
The following bugs are resolved with this release:
|
||||||
|
|
||||||
[The release manager will add the list generated by
|
[The release manager will add the list generated by
|
||||||
|
|
|
@ -65,7 +65,7 @@ shared-only-routines = $(routines)
|
||||||
endif
|
endif
|
||||||
|
|
||||||
tests = tst-xdrmem tst-xdrmem2 test-rpcent tst-udp-error tst-udp-timeout \
|
tests = tst-xdrmem tst-xdrmem2 test-rpcent tst-udp-error tst-udp-timeout \
|
||||||
tst-udp-nonblocking tst-bug22542
|
tst-udp-nonblocking tst-bug22542 tst-bug28768
|
||||||
|
|
||||||
xtests := tst-getmyaddr
|
xtests := tst-getmyaddr
|
||||||
|
|
||||||
|
|
|
@ -154,7 +154,10 @@ svcunix_create (int sock, u_int sendsize, u_int recvsize, char *path)
|
||||||
SVCXPRT *xprt;
|
SVCXPRT *xprt;
|
||||||
struct unix_rendezvous *r;
|
struct unix_rendezvous *r;
|
||||||
struct sockaddr_un addr;
|
struct sockaddr_un addr;
|
||||||
socklen_t len = sizeof (struct sockaddr_in);
|
socklen_t len = sizeof (addr);
|
||||||
|
|
||||||
|
if (__sockaddr_un_set (&addr, path) < 0)
|
||||||
|
return NULL;
|
||||||
|
|
||||||
if (sock == RPC_ANYSOCK)
|
if (sock == RPC_ANYSOCK)
|
||||||
{
|
{
|
||||||
|
@ -165,12 +168,6 @@ svcunix_create (int sock, u_int sendsize, u_int recvsize, char *path)
|
||||||
}
|
}
|
||||||
madesock = TRUE;
|
madesock = TRUE;
|
||||||
}
|
}
|
||||||
memset (&addr, '\0', sizeof (addr));
|
|
||||||
addr.sun_family = AF_UNIX;
|
|
||||||
len = strlen (path) + 1;
|
|
||||||
memcpy (addr.sun_path, path, len);
|
|
||||||
len += sizeof (addr.sun_family);
|
|
||||||
|
|
||||||
__bind (sock, (struct sockaddr *) &addr, len);
|
__bind (sock, (struct sockaddr *) &addr, len);
|
||||||
|
|
||||||
if (__getsockname (sock, (struct sockaddr *) &addr, &len) != 0
|
if (__getsockname (sock, (struct sockaddr *) &addr, &len) != 0
|
||||||
|
|
|
@ -0,0 +1,42 @@
|
||||||
|
/* Test to verify that long path is rejected by svcunix_create (bug 28768).
|
||||||
|
Copyright (C) 2022 Free Software Foundation, Inc.
|
||||||
|
This file is part of the GNU C Library.
|
||||||
|
|
||||||
|
The GNU C Library is free software; you can redistribute it and/or
|
||||||
|
modify it under the terms of the GNU Lesser General Public
|
||||||
|
License as published by the Free Software Foundation; either
|
||||||
|
version 2.1 of the License, or (at your option) any later version.
|
||||||
|
|
||||||
|
The GNU C Library is distributed in the hope that it will be useful,
|
||||||
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||||
|
Lesser General Public License for more details.
|
||||||
|
|
||||||
|
You should have received a copy of the GNU Lesser General Public
|
||||||
|
License along with the GNU C Library; if not, see
|
||||||
|
<http://www.gnu.org/licenses/>. */
|
||||||
|
|
||||||
|
#include <errno.h>
|
||||||
|
#include <rpc/svc.h>
|
||||||
|
#include <shlib-compat.h>
|
||||||
|
#include <string.h>
|
||||||
|
#include <support/check.h>
|
||||||
|
|
||||||
|
/* svcunix_create does not have a default version in linkobj/libc.so. */
|
||||||
|
compat_symbol_reference (libc, svcunix_create, svcunix_create, GLIBC_2_1);
|
||||||
|
|
||||||
|
static int
|
||||||
|
do_test (void)
|
||||||
|
{
|
||||||
|
char pathname[109];
|
||||||
|
memset (pathname, 'x', sizeof (pathname));
|
||||||
|
pathname[sizeof (pathname) - 1] = '\0';
|
||||||
|
|
||||||
|
errno = 0;
|
||||||
|
TEST_VERIFY (svcunix_create (RPC_ANYSOCK, 4096, 4096, pathname) == NULL);
|
||||||
|
TEST_COMPARE (errno, EINVAL);
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
#include <support/test-driver.c>
|
Loading…
Reference in New Issue