Re: [PATCH 0/4] Various nscd security fixes

[Carlos O'Donell <carlos@redhat.com>]

On 4/24/24 12:08, Florian Weimer wrote:
> Carlos filed bug 31677, and it it turns out that this is a reachable
> stack-based buffer overflow.  The data looks quite attacker-controlled
> to me and probably can contain NUL bytes with a custom client, so this
> looks quite exploitable to my untrained eye.
> 
> Unfortunately, the reproducer kept crashing after the initial patch,
> hence the second and third commit.  The two issues fixed in the last
> commit were discovered by reading through the code.
> 
> By my count, this needs four different CVE identifiers:

As part of the glibc security team I've reserved and updated bugzilla with 4 CVE IDs.

>   Bug 31677: the stack-based buffer overflow (commit 1)
>   Bug 31678: two distinct null pointer dereferences (commit 2, commit 3)
>     (same flaw type, presumably same version range, so MERGE from a
>     CVE perspective)
>   Bug 31679: process termination on malloc failure (commit 4)
>   Byg 31680: memory corruption due to incorrect callback API assumption
>     (commit 4)
> 
> Florian Weimer (4):
>   nscd: Stack-based buffer overflow in netgroup cache (bug 31677)
>   nscd: Do not send missing not-found response in addgetnetgrentX (bug
>     31678)
>   nscd: Avoid null pointer crashes after notfound response (bug 31678)
>   nscd: netgroup: Use two buffers in addgetnetgrentX (bug 31680)
> 
>  nscd/netgroupcache.c | 247 +++++++++++++++++++++++--------------------
>  1 file changed, 135 insertions(+), 112 deletions(-)
> 
> 
> base-commit: f4724843ada64a51d66f65d3199fe431f9d4c254

-- 
Cheers,
Carlos.