Bug 841290
| Summary: | pcp: __pmDecodeLogControl vulnerabilities | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Florian Weimer <fweimer> | ||||||
| Component: | pcp | Assignee: | Mark Goodwin <mgoodwin> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||
| Severity: | unspecified | Docs Contact: | |||||||
| Priority: | unspecified | ||||||||
| Version: | 16 | CC: | kenj, mgoodwin, nathans, security-response-team | ||||||
| Target Milestone: | --- | Keywords: | Security | ||||||
| Target Release: | --- | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | pcp-3.6.5 | Doc Type: | Bug Fix | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2012-08-20 04:00:49 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Bug Depends On: | |||||||||
| Bug Blocks: | 840765, 841698 | ||||||||
| Attachments: |
|
||||||||
|
Description
Florian Weimer
2012-07-18 15:04:32 UTC
Moving text form Environment field to proper comment: __pmDecodeLogControl does not check the c_numpmid and v_numval fields against the size of the PDU. Due to the way the sizes passed to malloc are calculated, heap objects could be allocated which are too small, leading to a heap-based buffer overflow. This seems to be exposed through pmlogger, but not through pmcd. Created attachment 600705 [details]
Resolve issues in decoding PCP logcontrol PDUs
(In reply to comment #2) > Created attachment 600705 [details] > Resolve issues in decoding PCP logcontrol PDUs I think this is fine, thanks. You can remove if (nv >= (INT_MAX - sizeof(vlist_t) - sizeof(__pmValue_PDU)) / sizeof(__pmValue_PDU)) goto corrupt; from the nv == 0 branch. Created attachment 600969 [details]
Updated patch to address PCP logcontrol PDU decoding issues
Incorporate Florian's review comments.
(In reply to comment #4) > Created attachment 600969 [details] > Updated patch to address PCP logcontrol PDU decoding issues > > Incorporate Florian's review comments. Still looks okay. Upstream patch: http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git;a=commit;h=b9f41448621b01988f72bd41d4764a5570e606ba This issue has been addressed in pcp-3.6.5 This issue was addressed in Fedora and EPEL via the following security updates: Fedora-16: https://admin.fedoraproject.org/updates/pcp-3.6.5-1.fc16 Fedora-17: https://admin.fedoraproject.org/updates/pcp-3.6.5-1.fc17 Rawhide: https://admin.fedoraproject.org/updates/pcp-3.6.5-1.fc18 EPEL-5: https://admin.fedoraproject.org/updates/pcp-3.6.5-1.el5 EPEL-6: https://admin.fedoraproject.org/updates/pcp-3.6.5-1.el6 |