Hide Forgot
Description of problem: The function list_missing_attrs() might in some circumstances return an undefined variable value, which leads to access to random memory and possibly a crash. Version-Release number of selected component (if applicable): 1.8.0-15 How reproducible: Unknown, Kaushik was able to occasionally reproduce this issue with service lookups. In general reproducing issues like this might be easier on 32bit architecture. You can easily spot the random access when running sssd_be in valgrind. Steps to Reproduce: 1. request a service 2. check out valgrind log or be lucky and witness a crash 3. Actual results: Expected results: Additional info: This was fixed upstream in the upstream 1.8 branch in 7d10875216a6b9e00c8a4063aa7df87a352fd530
Upstream ticket: https://fedorahosted.org/sssd/ticket/1270
(In reply to comment #2) > Upstream ticket: > https://fedorahosted.org/sssd/ticket/1270 That upstream ticket was actually describing two different issues. I split the undefined variable access into a new ticket https://fedorahosted.org/sssd/ticket/1283
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Cause: When an LDAP entry changed its attributes and was saved again into the SSSD cache, the SSSD might have accessed an undefined variable value Consequence: Accessing an undefined variable value crashed the SSSD Fix: The variable was initialized to a known default value Result: SSSD no longer crashed when updating cached entries
Created attachment 575318 [details] Crash backtrace
I able to reproduce the crash(sssd version 1.8.0-15) with the following steps: 1. Add the following services: dn: cn=Svc1,ou=Services,dc=example,dc=com objectClass: ipService cn: svc1_alias1 cn: SVC1_Alias2 ipServicePort: 1234 ipServiceProtocol: tcp dn: cn=Svc2,ou=Services,dc=example,dc=com objectClass: ipService cn: svc2_alias1 cn: SVC2_Alias2 ipServicePort: 1234 ipServiceProtocol: udp 2. sssd domain section: [domain/LDAP] debug_level=0xFFF0 id_provider = ldap ldap_uri = ldap://ldapsrv.example.com ldap_search_base = dc=example,dc=com 3. Lookup the services in the following way: # getent -s sss services 1234/tcp Svc1 1234/tcp svc1_alias1 SVC1_Alias2 # getent -s sss services 1234/udp <== no output. sssd_be crashes
Crash is no longer seen. Verified in version: # rpm -qi sssd | head Name : sssd Relocations: (not relocatable) Version : 1.8.0 Vendor: Red Hat, Inc. Release : 20.el6 Build Date: Fri 30 Mar 2012 06:45:57 PM IST Install Date: Mon 02 Apr 2012 05:36:37 PM IST Build Host: x86-002.build.bos.redhat.com Group : Applications/System Source RPM: sssd-1.8.0-20.el6.src.rpm Size : 7865577 License: GPLv3+ Signature : (none) Packager : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla> URL : http://fedorahosted.org/sssd/ Summary : System Security Services Daemon
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0747.html