Bug 1318890
Summary: | glibc: nss_db: long group entries are skipped | |||
---|---|---|---|---|
Product: | Red Hat Enterprise Linux 7 | Reporter: | Frank Hirtz <fhirtz> | |
Component: | glibc | Assignee: | Florian Weimer <fweimer> | |
Status: | CLOSED ERRATA | QA Contact: | Sergey Kolosov <skolosov> | |
Severity: | high | Docs Contact: | ||
Priority: | urgent | |||
Version: | 7.2 | CC: | alanm, ashankar, codonell, fkrska, fweimer, mcermak, mnewsome, mpetlan, pfrankli, skolosov | |
Target Milestone: | rc | Keywords: | FastFix, Patch, ZStream | |
Target Release: | --- | |||
Hardware: | All | |||
OS: | Linux | |||
Whiteboard: | ||||
Fixed In Version: | glibc-2.17-158.el7 | Doc Type: | Bug Fix | |
Doc Text: |
Cause: The nss_db Name Service Switch module fails to request larger result buffers when parsing group entries.
Consequence: Group entries whose size falls into a specific range are skipped.
Fix: nss_db now detects that the group list does not fit into the result buffer and requests are larger buffer.
Result: Group entries in the affected size range are processed correctly.
|
Story Points: | --- | |
Clone Of: | ||||
: | 1321861 1388637 (view as bug list) | Environment: | ||
Last Closed: | 2017-08-01 18:06:55 UTC | Type: | Bug | |
Regression: | --- | Mount Type: | --- | |
Documentation: | --- | CRM: | ||
Verified Versions: | Category: | --- | ||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
Cloudforms Team: | --- | Target Upstream Version: | ||
Embargoed: | ||||
Bug Depends On: | 1321861 | |||
Bug Blocks: | 1388637, 1390370 |
Description
Frank Hirtz
2016-03-18 03:59:42 UTC
Upstream commit: https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=a6033052d08027f745867e5e346852da1959226c Reproducer (needs to run as root): perl -e \ 'print "large:x:999:" . join(",", map {"user$_"} (1 .. 135))."\n"' \ >> /etc/group cd /var/db make getent -s db group After the fix, the last command should list the "large" group. The magic number 135 has been chosen so that the line is shorter than 1024 bytes, but the pointers required to encode the member array will cross the threshold, triggering the bug. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2017:1916 |