Red Hat Bugzilla – Bug 1149081
CVE-2014-3683 rsyslog: integer overflow in PRI parsing
Last modified: 2015-07-31 08:37:02 EDT
An integer overflow flaw was found in the way rsyslog and sysklogd daemons parsed PRI (priority value, that combines values for facility (such as mail, cron, or authpriv) and severity/level (such as crit, info, debug)) values form the log message provided to the syslog daemon. This problem could lead to bypass of the CVE-2014-3634 (bug 1142373) fix. The rsyslog upstream fixed this issue in version 7.6.7 and 8.4.2: http://lists.adiscon.net/pipermail/rsyslog/2014-October/038516.html http://lists.adiscon.net/pipermail/rsyslog/2014-October/038515.html A proposed fix for sysklogd is attached in bug 1142373 comment 16. Acknowledgment: Red Hat would like to thank the rsyslog upstream for reporting this issue. Upstream acknowledges mancha as the original reporter. External References: http://www.rsyslog.com/remote-syslog-pri-vulnerability-cve-2014-3683/
Further details of the impact of the original issue CVE-2014-3634 can be found in bug 1142373 comment 20. This integer overflow may cause f_pmask[] over-read (bug 1142373 comment 21) have worse impact on sysklogd and rsyslog 3.x, making it possible to reliably crash those versions. The textpri() impact on sysklogd and rsyslog 3.x is unchanged. In case of rsyslog 5.x and 7.x, this may give an attacker a better control over what memory will be used as facility name or length of the facility name, which may result in easier exploitation of the flaw.
While upstream advisory indicates this issue is an incomplete fix of CVE-2014-3634, the real problem was actually introduced by CVE-2014-3634 patches. Before those patches, there was an overflow in the way PRI value was parsed. Hence, syslog could use negative PRI value internally. However, the way facility number was extracted from PRI value using LOG_FAC ensured that the negative facility value was not used. The issue was corrected upstream via the following commit: http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=8a4ada4 The rsyslog upstream also provided updated patches for 3.x and 5.x that fix CVE-2014-3634 without introducing CVE-2014-3683 - see bug 1142373 comment 13, bug 1142373 comment 14 and bug 1142373 comment 29.
Statement: This issue did not affect the versions of sysklogd and rsyslog packages as shipped with Red Hat Enterprise Linux 5, 6, and7.