Bug 801533 - sssd_be crashes when resolving non-trivial nested group structure
Summary: sssd_be crashes when resolving non-trivial nested group structure
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: sssd
Version: 6.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Stephen Gallagher
QA Contact: IDM QE LIST
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-03-08 18:35 UTC by Jakub Hrozek
Modified: 2020-05-02 16:47 UTC (History)
4 users (show)

Fixed In Version: sssd-1.8.0-12.el6
Doc Type: Bug Fix
Doc Text:
Cause: When SSSD was resolving a complex group structure during an initgroups operation, it used a wrong counter and could have accessed random memory Consequence: The random memory access crashed the sssd_be process Fix: SSSD now uses the correct group counter Result: SSSD processes nested group structures correctly
Clone Of:
Environment:
Last Closed: 2012-06-20 11:55:51 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github SSSD sssd issues 2285 0 None None None 2020-05-02 16:47:53 UTC
Red Hat Product Errata RHBA-2012:0747 0 normal SHIPPED_LIVE sssd bug fix and enhancement update 2012-06-19 19:31:43 UTC

Description Jakub Hrozek 2012-03-08 18:35:20 UTC
Description of problem:
When SSSD is resolving memberships in a slightly complex group structure, the back end can crash. This is due to bad counter of parent groups in a nested group level.

Version-Release number of selected component (if applicable):
1.8.0

How reproducible:
always

Steps to Reproduce:
1. Configure a nested group structure that looks like this:

user --- A    -- BA --- BAA
  \          /     \
   \        /       \
     --- B -         -- BAB
            \
             \
              -- BB --- BBA
                   \
                    \
                     -- BBB

2. id user
  
Actual results:
segfault

Expected results:
id runs correctly

Additional info:
Reported by Bojan Smojver in https://bugzilla.redhat.com/show_bug.cgi?id=743133#c28

Comment 1 Jakub Hrozek 2012-03-08 18:38:02 UTC
Upstream ticket:
https://fedorahosted.org/sssd/ticket/1243

Comment 5 Jakub Hrozek 2012-04-03 18:44:36 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause: When SSSD was resolving a complex group structure during an initgroups operation, it used a wrong counter and could have accessed random memory

Consequence: The random memory access crashed the sssd_be process

Fix: SSSD now uses the correct group counter

Result: SSSD processes nested group structures correctly

Comment 6 Amith 2012-04-11 11:27:39 UTC
Verified on sssd-1.8.0-22.el6.x86_64.

The output for the associated beaker automation script is given below:

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: Verify BZ release ticket #364: sssd_be crashes when resolving non-trivial nested group structure
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: Running '/usr/bin/ldapadd -x -D cn=Manager,dc=example,dc=com -w Secret123 -H ldap://hubcap.lab.eng.pnq.redhat.com -f /tmp/tempuser.ldif > /dev/null 2>&1'
:: [   PASS   ] :: Running '/usr/bin/ldapadd -x -D cn=Manager,dc=example,dc=com -w Secret123 -H ldap://hubcap.lab.eng.pnq.redhat.com -f /tmp/tempgroup.ldif > /dev/null 2>&1'
:: [   PASS   ] :: Running '/usr/bin/id tempuser &'
:: [   PASS   ] :: Running '/bin/sleep 30s'
:: [   PASS   ] :: File '/tmp/templog' should not contain 'segfault at'
:: [   PASS   ] :: Running '/usr/bin/ldapmodify -x -D cn=Manager,dc=example,dc=com -w Secret123 -H ldap://hubcap.lab.eng.pnq.redhat.com -f /tmp/deluser.ldif > /dev/null 2>&1'
:: [   PASS   ] :: Running '/usr/bin/ldapmodify -x -D cn=Manager,dc=example,dc=com -w Secret123 -H ldap://hubcap.lab.eng.pnq.redhat.com -f /tmp/delgroup.ldif > /dev/null 2>&1'
:: [   LOG    ] :: Duration: 1m 22s
:: [   LOG    ] :: Assertions: 16 good, 0 bad
:: [   PASS   ] :: RESULT: Verify BZ release ticket #364: sssd_be crashes when resolving non-trivial nested group structure

Comment 8 errata-xmlrpc 2012-06-20 11:55:51 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0747.html


Note You need to log in before you can comment on or make changes to this bug.