Bug 694126 (CVE-2011-1489, CVE-2011-1490)

Summary:	CVE-2011-1489 CVE-2011-1490 rsyslog: Memory leak when multiple rulesets used
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	theinric
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-04-14 05:05:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2011-04-06 14:18:52 UTC

A memory leak was found in the way rsyslog system log deamon
processed log messages when multiple rulesets were used and
some output batches contained messages belonging to more than
one ruleset. A local attacker could use this flaw to cause denial
of the rsyslogd daemon service (excessive memory use and potential
abort) via a log message, belonging to more than one ruleset.

References:
[1] http://bugzilla.adiscon.com/show_bug.cgi?id=226
[2] http://bugzilla.adiscon.com/show_bug.cgi?id=218
[3] http://www.openwall.com/lists/oss-security/2011/03/29/3
[4] http://www.openwall.com/lists/oss-security/2011/04/04/41

Upstream patch:
[5] http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=1ef709cc97d54f74d3fdeb83788cc4b01f4c6a2a

Comment 1 Jan Lieskovsky 2011-04-06 14:23:35 UTC

Public PoC (from [1]):
======================
Repro:
simple config:
$ModLoad /home/rger/proj/rsyslog/plugins/imudp/.libs/imudp
$ModLoad /home/rger/proj/rsyslog/plugins/imtcp/.libs/imtcp
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$Ruleset RemoteHostRule
$InputTCPServerBindRuleset RemoteHostRule
$InputTCPServerRun 10514
$UDPServerRun 10514
*.*     /dev/null

Note that when the BindRuleSet directive is removed, no memory leak occurs.

run two traffic generators for a couple of seconds:
$ ./tcpflood -t 172.19.3.27 -p 10514 -m 10000000000 -c4 -Y -d350 -es -Tudp -b10
-W1000

$ ./tcpflood -t 172.19.3.27 -p 10514 -m 10000000000 -c4 -Y -d350 -es

Comment 4 Huzaifa S. Sidhpurwala 2011-04-14 05:05:04 UTC

This issue did NOT affect the versions of the rsyslog package,
as shipped with Red Hat Enterprise Linux 5 and 6.

This issue did NOT affect the versions of the rsyslog package,
as shipped with Fedora release of 13 and 14.

Comment 5 Huzaifa S. Sidhpurwala 2011-04-14 05:05:21 UTC

Statement:

Not vulnerable. This issue did not affect the versions of rsyslog as
shipped with Red Hat Enterprise Linux 5 and 6.