Bug 731990

Summary: dhcpd can segfault when scanning TUN interface during start
Product: Red Hat Enterprise Linux 6 Reporter: Ronald Wahl <ronald.wahl>
Component: dhcpAssignee: Jiri Popelka <jpopelka>
Status: CLOSED ERRATA QA Contact: Release Test Team <release-test-team-automation>
Severity: high Docs Contact:
Priority: medium    
Version: 6.1CC: chkr, mganisin, msvoboda, rvokal, wolf
Target Milestone: rcKeywords: Patch
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: dhcp-4.1.1-22.P1.el6 Doc Type: Bug Fix
Doc Text:
If the system included network interfaces with no hardware address, the dhcpd scan could have caused a segmentation fault when scanning such an interface. As a consequence, the dhcp daemon unexpectedly terminated. To prevent this issue, dhcpd now tests a pointer which represents the hardware address of the interface for the NULL value. The dhcp daemon no longer crashes.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2011-12-06 12:01:00 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Fix segmentation fault during start of dhcpd (and dhclient) none

Description Ronald Wahl 2011-08-19 11:51:50 UTC 
Created attachment 519025 [details]
Fix segmentation fault during start of dhcpd (and dhclient)

Description of problem:
When dhcpd is started a segmentation fault may occur when there are network interfaces without a hardware address. For example we have a tun0 and a tun1 device (created by a running openvpn daemon) and these do not have a hardware address. If the dhcpd scans the interfaces on start it dereferences a pointer without checking if it is NULL. Attached fix taken from here:

http://www.mail-archive.com/scientific-linux-users@listserv.fnal.gov/msg09049.html


Version-Release number of selected component (if applicable):
dhcp-4.1.1-19.P1.el6_1.1.x86_64

How reproducible:
Depends on the interface order - if the interfaces without a hardware address are registered before the interfaces where dhcpd should listen then 100% otherwise it is not reproducible.


Steps to Reproduce:
1. Create some tun devices
2. Create new ethernet device (or restart network)
3. Start dhcpd on this new ethernet device
  
Actual results:
dhcpd segfaults

Expected results:
dhcpd should work as expected

Additional info:
dhclient might be affected as well by the same issue
Comment 4 Miroslav Svoboda 2011-08-30 10:57:56 UTC 
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
If the system included network interfaces with no hardware address, the dhcpd scan could have caused a segmentation fault when scanning such an interface. As a consequence, the dhcp daemon unexpectedly terminated. To prevent this issue, dhcpd now tests a pointer which represents the hardware address of the interface for the NULL value. The dhcp daemon no longer crashes.
Comment 5 Jiri Popelka 2011-09-07 08:59:36 UTC 
*** Bug 736149 has been marked as a duplicate of this bug. ***
Comment 7 errata-xmlrpc 2011-12-06 12:01:00 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1597.html