unofficial mirror of libc-alpha@sourceware.org
 help / color / mirror / Atom feed
From: Florian Weimer <fweimer@redhat.com>
To: "Cristian Rodríguez" <cristian@rodriguez.im>
Cc: libc-alpha@sourceware.org
Subject: Re: [PATCH 0/4] Various nscd security fixes
Date: Fri, 26 Apr 2024 10:10:30 +0200	[thread overview]
Message-ID: <87edas4k95.fsf@oldenburg.str.redhat.com> (raw)
In-Reply-To: <CAPBLoAfQ1YSx5qLpD1da8a__Hbii4m=WRzO_qWu6AjzpAxbtAQ@mail.gmail.com> ("Cristian Rodríguez"'s message of "Thu, 25 Apr 2024 20:10:20 -0400")

* Cristian Rodríguez:

> On Wed, Apr 24, 2024 at 12:08 PM Florian Weimer <fweimer@redhat.com> wrote:
>>
>> Carlos filed bug 31677, and it it turns out that this is a reachable
>> stack-based buffer overflow.  The data looks quite attacker-controlled
>> to me and probably can contain NUL bytes with a custom client, so this
>> looks quite exploitable to my untrained eye.
>>
>> Unfortunately, the reproducer kept crashing after the initial patch,
>> hence the second and third commit.  The two issues fixed in the last
>> commit were discovered by reading through the code.
>
>
> I 'm probably missing something but isn't NSCD de-facto EOL ?

It's not EOL for some downstreams.  We have to fix issues as we
encounter them.  We might as well share the patches with upstream.

This shouldn't prevent removal of nscd from the upstream sources.
If that happens, we can still contribute fixes to stable branches.

Thanks,
Florian


      reply	other threads:[~2024-04-26  8:11 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-04-24 16:08 [PATCH 0/4] Various nscd security fixes Florian Weimer
2024-04-24 16:08 ` [PATCH 1/4] nscd: Stack-based buffer overflow in netgroup cache (bug 31677) Florian Weimer
2024-04-24 16:27   ` Siddhesh Poyarekar
2024-04-24 16:08 ` [PATCH 2/4] nscd: Do not send missing not-found response in addgetnetgrentX (bug 31678) Florian Weimer
2024-04-24 16:35   ` Siddhesh Poyarekar
2024-04-24 16:08 ` [PATCH 3/4] nscd: Avoid null pointer crashes after notfound response " Florian Weimer
2024-04-24 16:39   ` Siddhesh Poyarekar
2024-04-24 16:08 ` [PATCH 4/4] nscd: netgroup: Use two buffers in addgetnetgrentX (bug 31680) Florian Weimer
2024-04-24 16:48   ` Siddhesh Poyarekar
2024-04-24 20:53 ` [PATCH 0/4] Various nscd security fixes Carlos O'Donell
2024-04-26  0:10 ` Cristian Rodríguez
2024-04-26  8:10   ` Florian Weimer [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://www.gnu.org/software/libc/involved.html

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87edas4k95.fsf@oldenburg.str.redhat.com \
    --to=fweimer@redhat.com \
    --cc=cristian@rodriguez.im \
    --cc=libc-alpha@sourceware.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).