Bug 731990 - dhcpd can segfault when scanning TUN interface during start
dhcpd can segfault when scanning TUN interface during start
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: dhcp (Show other bugs)
6.1
Unspecified Unspecified
medium Severity high
: rc
: ---
Assigned To: Jiri Popelka
Release Test Team
: Patch
: 736149 (view as bug list)
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2011-08-19 07:51 EDT by Ronald Wahl
Modified: 2011-12-06 07:01 EST (History)
5 users (show)

See Also:
Fixed In Version: dhcp-4.1.1-22.P1.el6
Doc Type: Bug Fix
Doc Text:
If the system included network interfaces with no hardware address, the dhcpd scan could have caused a segmentation fault when scanning such an interface. As a consequence, the dhcp daemon unexpectedly terminated. To prevent this issue, dhcpd now tests a pointer which represents the hardware address of the interface for the NULL value. The dhcp daemon no longer crashes.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2011-12-06 07:01:00 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
Fix segmentation fault during start of dhcpd (and dhclient) (329 bytes, patch)
2011-08-19 07:51 EDT, Ronald Wahl
no flags Details | Diff

  None (edit)
Description Ronald Wahl 2011-08-19 07:51:50 EDT
Created attachment 519025 [details]
Fix segmentation fault during start of dhcpd (and dhclient)

Description of problem:
When dhcpd is started a segmentation fault may occur when there are network interfaces without a hardware address. For example we have a tun0 and a tun1 device (created by a running openvpn daemon) and these do not have a hardware address. If the dhcpd scans the interfaces on start it dereferences a pointer without checking if it is NULL. Attached fix taken from here:

http://www.mail-archive.com/scientific-linux-users@listserv.fnal.gov/msg09049.html


Version-Release number of selected component (if applicable):
dhcp-4.1.1-19.P1.el6_1.1.x86_64

How reproducible:
Depends on the interface order - if the interfaces without a hardware address are registered before the interfaces where dhcpd should listen then 100% otherwise it is not reproducible.


Steps to Reproduce:
1. Create some tun devices
2. Create new ethernet device (or restart network)
3. Start dhcpd on this new ethernet device
  
Actual results:
dhcpd segfaults

Expected results:
dhcpd should work as expected

Additional info:
dhclient might be affected as well by the same issue
Comment 4 Miroslav Svoboda 2011-08-30 06:57:56 EDT
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
If the system included network interfaces with no hardware address, the dhcpd scan could have caused a segmentation fault when scanning such an interface. As a consequence, the dhcp daemon unexpectedly terminated. To prevent this issue, dhcpd now tests a pointer which represents the hardware address of the interface for the NULL value. The dhcp daemon no longer crashes.
Comment 5 Jiri Popelka 2011-09-07 04:59:36 EDT
*** Bug 736149 has been marked as a duplicate of this bug. ***
Comment 7 errata-xmlrpc 2011-12-06 07:01:00 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1597.html

Note You need to log in before you can comment on or make changes to this bug.