Red Hat Bugzilla – Full Text Bug Listing
|Summary:||pcp: malicious client can stop all pmcd server activity|
|Product:||[Fedora] Fedora||Reporter:||Florian Weimer <fweimer>|
|Component:||pcp||Assignee:||Mark Goodwin <mgoodwin>|
|Status:||CLOSED ERRATA||QA Contact:||Fedora Extras Quality Assurance <extras-qa>|
|Version:||16||CC:||fche, kenj, mgoodwin, nathans, security-response-team|
|Fixed In Version:||pcp-3.6.5||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|Last Closed:||2012-08-20 00:05:25 EDT||Type:||Bug|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Bug Depends On:|
|Bug Blocks:||840765, 841706|
Description Florian Weimer 2012-07-18 12:25:01 EDT
The pduread function in libpcp performs a select locally, waiting for more client data. A malicious client can send individual bytes one by one, to avoid the timeout, and monopolize the pmcd server this way. No authentication is required. As a stop-gap measure, a low overall timeout for the whole PDU should be enforced, and not just a timeout for each individual recv call. A real fix requires a proper event-driven style, that is, all I/O has to be performed in the main event loop, and the I/O routines have to be transformed to continuation-passing style.
Comment 2 Nathan Scott 2012-08-06 18:18:30 EDT
Created attachment 602593 [details] Resolve an event-driven programming flaw in pmcd Attached is Ken McDonells fix for this. I was a little confused by 841706 which I think is another bug for the same issue, and attached it there late last week. Here it is again anyway.
Comment 3 Florian Weimer 2012-08-07 04:00:20 EDT
(In reply to comment #2) > Created attachment 602593 [details] > Resolve an event-driven programming flaw in pmcd > > Attached is Ken McDonells fix for this. I think dead_hand.tv_usec needs to be adjusted in the if branch, so that it does not exceed 1000000. The comparison needs to be >=, not >. gettimeofday(&dead_hand, NULL); dead_hand.tv_sec += wait.tv_sec; dead_hand.tv_usec += wait.tv_usec; if (dead_hand.tv_usec > 1000000) dead_hand.tv_sec++; Perhaps a comment should be added that this is just a stop-gap measure and that the real fix is more involved.
Comment 4 Nathan Scott 2012-08-07 22:08:53 EDT
Created attachment 602904 [details] Updated version of pmcd event-driven programming flaw patch Incorporate Florian's review comments.
Comment 5 Huzaifa S. Sidhpurwala 2012-08-16 00:13:43 EDT
Upstream patch: http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git;a=commit;h=9ba85dca940de976176ce196fd5e3c4170936354 This issue has been addressed in pcp-3.6.5
Comment 6 Huzaifa S. Sidhpurwala 2012-08-20 00:04:33 EDT
This issue was addressed in Fedora and EPEL via the following security updates: Fedora-16: https://admin.fedoraproject.org/updates/pcp-3.6.5-1.fc16 Fedora-17: https://admin.fedoraproject.org/updates/pcp-3.6.5-1.fc17 Rawhide: https://admin.fedoraproject.org/updates/pcp-3.6.5-1.fc18 EPEL-5: https://admin.fedoraproject.org/updates/pcp-3.6.5-1.el5 EPEL-6: https://admin.fedoraproject.org/updates/pcp-3.6.5-1.el6