Bug 1097815 (CVE-2014-0244)

Thanks for the detailed report and the reproducer, that helped a lot.

I managed to reproduce the issue. When nmbd hangs, it has the following backtrace:

#0  0x00002ba5fb059d53 in __recvfrom_nocancel () from /lib64/libc.so.6
#1  0x00002ba5f85e506d in recvfrom (s=12, buf=0x7fff3cbe5940, len=576, flags=0, from=0x7fff3cbe5b80, fromlen=0x7fff3cbe5914)
    at /usr/include/bits/socket2.h:55
#2  sys_recvfrom (s=12, buf=0x7fff3cbe5940, len=576, flags=0, from=0x7fff3cbe5b80, fromlen=0x7fff3cbe5914) at lib/system.c:288
#3  0x00002ba5f85f6a73 in read_udp_v4_socket (fd=12, buf=0x7fff3cbe5940 "PW\276<\377\177", len=576, psa=0x7fff3cbe5b80) at lib/util_sock.c:259
#4  0x00002ba5f853ddb8 in read_packet (fd=12, packet_type=DGRAM_PACKET) at libsmb/nmblib.c:802
#5  0x00002ba5f84c7601 in listen_for_packets (run_election=<value optimized out>) at nmbd/nmbd_packets.c:1971
#6  0x00002ba5f84bae0b in process (argc=<value optimized out>, argv=<value optimized out>) at nmbd/nmbd.c:493
#7  main (argc=<value optimized out>, argv=<value optimized out>) at nmbd/nmbd.c:1020


read_udp_v4_socket has the following code:
ret = (ssize_t)sys_recvfrom(fd,buf,len,0,
		(struct sockaddr *)psa,&socklen);
if (ret <= 0) {
	/* Don't print a low debug error for a non-blocking socket. */
	if (errno == EAGAIN) {
		DEBUG(10,("read_udp_v4_socket: returned EAGAIN\n"));
	} else {
		DEBUG(2,("read_udp_v4_socket: failed. errno=%s\n",
			strerror(errno)));
	}
	return 0;
}

So, we can see it calls sys_recvfrom() and wants to bail out if it encounters EAGAIN return values.

Now, the interesting part is how sys_recvfrom() is implemented:
ssize_t sys_recvfrom(int s, void *buf, size_t len, int flags, struct sockaddr *from, socklen_t *fromlen)
{
	ssize_t ret;

	do {
		ret = recvfrom(s, buf, len, flags, from, fromlen);
#if defined(EWOULDBLOCK)
	} while (ret == -1 && (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK));
#else
	} while (ret == -1 && (errno == EINTR || errno == EAGAIN));
#endif
	return ret;
}

We see that it simply loops the recvfrom() and continues doing so if it encounters -1 or EAGAIN, so there's a chance that we end up looping endlessly. Also, it will never propagate -1/EAGAIN errors up to read_udp_v4_socket, so the check in read_udp_v4_socket is essentially useless at this point.

Public now.

External Reference:

http://www.samba.org/samba/security/CVE-2014-0244

Created samba tracking bugs for this issue:

Affects: fedora-all [bug 1112251]

The upstream patch is here:

http://git.samba.org/?p=samba.git;a=commitdiff;h=d77a74237e660dd2ce9f1e14b02635f8a2569653

IssueDescription:

A denial of service flaw was found in the way the sys_recvfile() function of nmbd, the NetBIOS message block daemon, processed non-blocking sockets. An attacker could send a specially crafted packet that, when processed, would cause nmbd to enter an infinite loop and consume an excessive amount of CPU time.

This issue has been addressed in following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:0867 https://rhn.redhat.com/errata/RHSA-2014-0867.html

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5

Via RHSA-2014:0866 https://rhn.redhat.com/errata/RHSA-2014-0866.html

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2014:1009 https://rhn.redhat.com/errata/RHSA-2014-1009.html