You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
102 lines
3.4 KiB
102 lines
3.4 KiB
commit 6890b8a3ae40ab9d4c96024ab95b04816fcc8a4a |
|
Author: Florian Weimer <fweimer@redhat.com> |
|
Date: Mon Jan 17 11:49:25 2022 +0100 |
|
|
|
CVE-2022-23218: Buffer overflow in sunrpc svcunix_create (bug 28768) |
|
|
|
The sunrpc function svcunix_create suffers from a stack-based buffer |
|
overflow with overlong pathname arguments. |
|
|
|
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> |
|
(cherry picked from commit f545ad4928fa1f27a3075265182b38a4f939a5f7) |
|
|
|
diff --git a/sunrpc/Makefile b/sunrpc/Makefile |
|
index a4281b18d04c78e9..6408ab5c073538e9 100644 |
|
--- a/sunrpc/Makefile |
|
+++ b/sunrpc/Makefile |
|
@@ -65,7 +65,7 @@ shared-only-routines = $(routines) |
|
endif |
|
|
|
tests = tst-xdrmem tst-xdrmem2 test-rpcent tst-udp-error tst-udp-timeout \ |
|
- tst-udp-nonblocking tst-bug22542 |
|
+ tst-udp-nonblocking tst-bug22542 tst-bug28768 |
|
|
|
xtests := tst-getmyaddr |
|
|
|
diff --git a/sunrpc/svc_unix.c b/sunrpc/svc_unix.c |
|
index 679fbe9cb69587bd..46f8d16fe94a3d4f 100644 |
|
--- a/sunrpc/svc_unix.c |
|
+++ b/sunrpc/svc_unix.c |
|
@@ -154,7 +154,10 @@ svcunix_create (int sock, u_int sendsize, u_int recvsize, char *path) |
|
SVCXPRT *xprt; |
|
struct unix_rendezvous *r; |
|
struct sockaddr_un addr; |
|
- socklen_t len = sizeof (struct sockaddr_in); |
|
+ socklen_t len = sizeof (addr); |
|
+ |
|
+ if (__sockaddr_un_set (&addr, path) < 0) |
|
+ return NULL; |
|
|
|
if (sock == RPC_ANYSOCK) |
|
{ |
|
@@ -165,12 +168,6 @@ svcunix_create (int sock, u_int sendsize, u_int recvsize, char *path) |
|
} |
|
madesock = TRUE; |
|
} |
|
- memset (&addr, '\0', sizeof (addr)); |
|
- addr.sun_family = AF_UNIX; |
|
- len = strlen (path) + 1; |
|
- memcpy (addr.sun_path, path, len); |
|
- len += sizeof (addr.sun_family); |
|
- |
|
__bind (sock, (struct sockaddr *) &addr, len); |
|
|
|
if (__getsockname (sock, (struct sockaddr *) &addr, &len) != 0 |
|
diff --git a/sunrpc/tst-bug28768.c b/sunrpc/tst-bug28768.c |
|
new file mode 100644 |
|
index 0000000000000000..35a4b7b0b3d34350 |
|
--- /dev/null |
|
+++ b/sunrpc/tst-bug28768.c |
|
@@ -0,0 +1,42 @@ |
|
+/* Test to verify that long path is rejected by svcunix_create (bug 28768). |
|
+ Copyright (C) 2022 Free Software Foundation, Inc. |
|
+ This file is part of the GNU C Library. |
|
+ |
|
+ The GNU C Library is free software; you can redistribute it and/or |
|
+ modify it under the terms of the GNU Lesser General Public |
|
+ License as published by the Free Software Foundation; either |
|
+ version 2.1 of the License, or (at your option) any later version. |
|
+ |
|
+ The GNU C Library is distributed in the hope that it will be useful, |
|
+ but WITHOUT ANY WARRANTY; without even the implied warranty of |
|
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
|
+ Lesser General Public License for more details. |
|
+ |
|
+ You should have received a copy of the GNU Lesser General Public |
|
+ License along with the GNU C Library; if not, see |
|
+ <http://www.gnu.org/licenses/>. */ |
|
+ |
|
+#include <errno.h> |
|
+#include <rpc/svc.h> |
|
+#include <shlib-compat.h> |
|
+#include <string.h> |
|
+#include <support/check.h> |
|
+ |
|
+/* svcunix_create does not have a default version in linkobj/libc.so. */ |
|
+compat_symbol_reference (libc, svcunix_create, svcunix_create, GLIBC_2_1); |
|
+ |
|
+static int |
|
+do_test (void) |
|
+{ |
|
+ char pathname[109]; |
|
+ memset (pathname, 'x', sizeof (pathname)); |
|
+ pathname[sizeof (pathname) - 1] = '\0'; |
|
+ |
|
+ errno = 0; |
|
+ TEST_VERIFY (svcunix_create (RPC_ANYSOCK, 4096, 4096, pathname) == NULL); |
|
+ TEST_COMPARE (errno, EINVAL); |
|
+ |
|
+ return 0; |
|
+} |
|
+ |
|
+#include <support/test-driver.c>
|
|
|