Bug 1932589 (CVE-2021-27645)

Summary:	CVE-2021-27645 glibc: Use-after-free in addgetnetgrentX function in netgroupcache.c
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	aoliva, arjun.is, ashankar, bdettelb, codonell, dj, fweimer, glibc-bugzilla, huzaifas, kaycoth, mfabian, mnewsome, pfrankli, rth, security-response-team, sipoyare, tomckay, vmugicag
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	glibc 2.34	Doc Type:	If docs needed, set a value
Doc Text:	The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6), when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-09 20:21:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1927877, 1932590, 1933582
Bug Blocks:	1932591

Description Pedro Sampaio 2021-02-24 18:54:09 UTC

The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.

Upstream bug:

https://sourceware.org/bugzilla/show_bug.cgi?id=27462

Comment 1 Pedro Sampaio 2021-02-24 18:55:42 UTC

Created glibc tracking bugs for this issue:

Affects: fedora-all [bug 1932590]

Comment 7 Huzaifa S. Sidhpurwala 2021-03-04 04:01:47 UTC

Upstream patch: https://sourceware.org/git/?p=glibc.git;a=commit;h=dca565886b5e8bd7966e15f0ca42ee5cff686673

Comment 8 Huzaifa S. Sidhpurwala 2021-03-04 04:09:48 UTC

Statement:

This is a local crash in nscd causing a performance penalty. It is constrained by needing a netgroup request to have a response larger than 1K to cause the double-free crash. Therefore this is not a full denial of service.

Comment 11 errata-xmlrpc 2021-11-09 18:28:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4358 https://access.redhat.com/errata/RHSA-2021:4358

Comment 12 Product Security DevOps Team 2021-11-09 20:21:03 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-27645