Bug 805034

Summary: accessing an undefined variable might cause crash
Product: Red Hat Enterprise Linux 6 Reporter: Jakub Hrozek <jhrozek>
Component: sssdAssignee: Stephen Gallagher <sgallagh>
Status: CLOSED ERRATA QA Contact: IDM QE LIST <seceng-idm-qe-list>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.3CC: grajaiya, jgalipea, kbanerje, prc
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: sssd-1.8.0-17.el6 Doc Type: Bug Fix
Doc Text:
Cause: When an LDAP entry changed its attributes and was saved again into the SSSD cache, the SSSD might have accessed an undefined variable value Consequence: Accessing an undefined variable value crashed the SSSD Fix: The variable was initialized to a known default value Result: SSSD no longer crashed when updating cached entries
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-06-20 11:56:12 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Crash backtrace none

Description Jakub Hrozek 2012-03-20 13:49:26 UTC
Description of problem:
The function list_missing_attrs() might in some circumstances return an undefined variable value, which leads to access to random memory and possibly a crash.

Version-Release number of selected component (if applicable):
1.8.0-15

How reproducible:
Unknown, Kaushik was able to occasionally reproduce this issue with service lookups. In general reproducing issues like this might be easier on 32bit architecture.

You can easily spot the random access when running sssd_be in valgrind.

Steps to Reproduce:
1. request a service
2. check out valgrind log or be lucky and witness a crash
3.
  
Actual results:


Expected results:


Additional info:
This was fixed upstream in the upstream 1.8 branch in 7d10875216a6b9e00c8a4063aa7df87a352fd530

Comment 2 Jakub Hrozek 2012-03-26 14:51:33 UTC
Upstream ticket:
https://fedorahosted.org/sssd/ticket/1270

Comment 3 Jakub Hrozek 2012-03-30 19:30:04 UTC
(In reply to comment #2)
> Upstream ticket:
> https://fedorahosted.org/sssd/ticket/1270

That upstream ticket was actually describing two different issues. I split the undefined variable access into a new ticket https://fedorahosted.org/sssd/ticket/1283

Comment 4 Jakub Hrozek 2012-04-03 18:55:00 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause: When an LDAP entry changed its attributes and was saved again into the SSSD cache, the SSSD might have accessed an undefined variable value

Consequence: Accessing an undefined variable value crashed the SSSD

Fix: The variable was initialized to a known default value

Result: SSSD no longer crashed when updating cached entries

Comment 5 Kaushik Banerjee 2012-04-05 08:23:34 UTC
Created attachment 575318 [details]
Crash backtrace

Comment 6 Kaushik Banerjee 2012-04-05 08:27:58 UTC
I able to reproduce the crash(sssd version 1.8.0-15) with the following steps:

1. Add the following services:

dn: cn=Svc1,ou=Services,dc=example,dc=com
objectClass: ipService
cn: svc1_alias1
cn: SVC1_Alias2
ipServicePort: 1234
ipServiceProtocol: tcp
 
dn: cn=Svc2,ou=Services,dc=example,dc=com
objectClass: ipService
cn: svc2_alias1
cn: SVC2_Alias2
ipServicePort: 1234
ipServiceProtocol: udp
 
2. sssd domain section:
[domain/LDAP]
debug_level=0xFFF0
id_provider = ldap
ldap_uri = ldap://ldapsrv.example.com
ldap_search_base = dc=example,dc=com
 
3. Lookup the services in the following way:
 
# getent -s sss services 1234/tcp
Svc1                  1234/tcp svc1_alias1 SVC1_Alias2
 
# getent -s sss services 1234/udp        <== no output. sssd_be crashes

Comment 7 Kaushik Banerjee 2012-04-05 08:29:03 UTC
Crash is no longer seen.

Verified in version:
# rpm -qi sssd | head
Name        : sssd                         Relocations: (not relocatable)
Version     : 1.8.0                             Vendor: Red Hat, Inc.
Release     : 20.el6                        Build Date: Fri 30 Mar 2012 06:45:57 PM IST
Install Date: Mon 02 Apr 2012 05:36:37 PM IST      Build Host: x86-002.build.bos.redhat.com
Group       : Applications/System           Source RPM: sssd-1.8.0-20.el6.src.rpm
Size        : 7865577                          License: GPLv3+
Signature   : (none)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://fedorahosted.org/sssd/
Summary     : System Security Services Daemon

Comment 9 errata-xmlrpc 2012-06-20 11:56:12 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0747.html