Bug 841183

Summary: Missing namelen check in __pmDecodeFetch
Product: [Fedora] Fedora Reporter: Florian Weimer <fweimer>
Component: pcpAssignee: Nathan Scott <nathans>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 16CC: kenj, mgoodwin, nathans, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: pcp-3.6.5 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-08-19 23:54:06 EDT Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On:    
Bug Blocks: 840765, 841698    
Attachments:
Description Flags
Resolve issues in decoding PCP fetch PDUs
none
Updated patch to address PCP fetch PDU decoding issues none

Description Florian Weimer 2012-07-18 07:19:55 EDT
pmcd crashes when processing a crafted PDU_FETCH request because of a missing length check in __pmDecodeFetch.  Code execution through this bug appears unlikely because the loop which runs past the end of the PDU only performs byte swapping (on little-endian architectures).
Comment 2 Mark Goodwin 2012-07-22 19:45:42 EDT
Nathan requested assignment, thanks Nathan.
Comment 3 Nathan Scott 2012-07-22 21:01:47 EDT
Created attachment 599665 [details]
Resolve issues in decoding PCP fetch PDUs

Proposed fix attached.  Please review, thanks.
Comment 4 Florian Weimer 2012-07-23 07:38:01 EDT
(In reply to comment #3)
> Created attachment 599665 [details]
> Resolve issues in decoding PCP fetch PDUs
> 
> Proposed fix attached.  Please review, thanks.

    if ((pduend - (char*)pp) != sizeof(fetch_t) + ((sizeof(pmID)) * (numpmid-1)))

The expression (sizeof(pmID)) * (numpmid-1) can overflow (for instance, if numpmid is 0x40000001), so the check does not catch all cases where numpmid and the actual number of elements disagree.
Comment 5 Nathan Scott 2012-07-23 22:40:10 EDT
Created attachment 599891 [details]
Updated patch to address PCP fetch PDU decoding issues
Comment 6 Huzaifa S. Sidhpurwala 2012-08-15 23:53:43 EDT
Upstream patch:

http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git;a=commit;h=7eb479b91ef12bf89a15b078af2107c8c4746a4a

This issue has been addressed in pcp-3.6.5