Bug 832913 - GeoIP: crash due to lack of segment size validation
GeoIP: crash due to lack of segment size validation
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: GeoIP (Show other bugs)
21
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Paul Howarth
Fedora Extras Quality Assurance
: Reopened
Depends On:
Blocks: 832899
  Show dependency treegraph
 
Reported: 2012-06-18 03:58 EDT by Florian Weimer
Modified: 2015-05-14 02:28 EDT (History)
3 users (show)

See Also:
Fixed In Version: GeoIP-1.6.5-1.fc21
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-04-26 11:36:03 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
large.c (681 bytes, text/plain)
2012-06-18 03:58 EDT, Florian Weimer
no flags Details
GeoIPASNum.dat-large (10 bytes, application/octet-stream)
2012-06-18 03:59 EDT, Florian Weimer
no flags Details

  None (edit)
Description Florian Weimer 2012-06-18 03:58:04 EDT
Created attachment 592554 [details]
large.c

large.c crashes in the GEOIP_MEMORY_CACHE and GEOIP_MMAP_CACHE modes
because the segment size is never validated against the file size.  In
GEOIP_INDEX_CACHE mode, it allocates a large amount of memory,
potentially leading to a denial of service.

I'm filing this as a private bug even though this is not a security vulnerability as such because no trust boundary is crossed.  Please treat the reproducer as confidential.
Comment 1 Florian Weimer 2012-06-18 03:59:47 EDT
Created attachment 592555 [details]
GeoIPASNum.dat-large

Data file used by large.c.
Comment 2 Fedora Admin XMLRPC Client 2012-10-22 10:21:53 EDT
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.
Comment 3 Paul Howarth 2012-10-22 10:43:53 EDT
There is no information in this bug report that would allow me to identify the problem. I don't have access to Bug #832899 either so that doesn't help.
Comment 4 Paul Howarth 2013-02-20 09:16:47 EST
Florian, are you still wanting to treat this as confidential or is it OK to report this on upstream's github account? Upstream seems to be working towards a 1.5.0 release at the moment.

Also I don't have access to Bug #832919, which appears to a Fedora GeoIP bug according to https://admin.fedoraproject.org/pkgdb/acls/bugs/GeoIP - are you or someone else dealing with upstream for that one?
Comment 5 Jaroslav Reznik 2013-02-26 09:52:41 EST
Fedora 16 changed to end-of-life (EOL) status on 2013-02-12. Fedora 16 is 
no longer maintained, which means that it will not receive any further 
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
Fedora please feel free to reopen this bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.
Comment 6 Paul Howarth 2013-02-26 10:00:49 EST
No change since F-16.
Comment 7 Paul Howarth 2013-04-02 11:53:18 EDT
Florian, are you still wanting to treat this as confidential or is it OK to report this on upstream's github account?
Comment 8 Florian Weimer 2013-04-03 02:35:54 EDT
It's fine to report this upstream.  Sorry for the delay.
Comment 9 Fedora End Of Life 2013-04-03 15:37:31 EDT
This bug appears to have been reported against 'rawhide' during the Fedora 19 development cycle.
Changing version to '19'.

(As we did not run this process for some time, it could affect also pre-Fedora 19 development
cycle bugs. We are very sorry. It will help us with cleanup during Fedora 19 End Of Life. Thank you.)

More information and reason for this action is here:
https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora19
Comment 10 Fedora End Of Life 2015-01-09 16:59:06 EST
This message is a notice that Fedora 19 is now at end of life. Fedora 
has stopped maintaining and issuing updates for Fedora 19. It is 
Fedora's policy to close all bug reports from releases that are no 
longer maintained. Approximately 4 (four) weeks from now this bug will
be closed as EOL if it remains open with a Fedora 'version' of '19'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 19 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.
Comment 11 Paul Howarth 2015-01-10 07:57:32 EST
Philip, did anything happen with this upstream?
Comment 12 Philip Prindeville 2015-01-11 13:56:30 EST
(In reply to Paul Howarth from comment #11)
> Philip, did anything happen with this upstream?

I believe it was fixed.  Let me check github.
Comment 13 Philip Prindeville 2015-01-11 14:08:17 EST
(In reply to Philip Prindeville from comment #12)

> I believe it was fixed.  Let me check github.

Nope, wasn't fixed. Since neither of us have access to the original bug, I was thinking that Florian was going to report it upstream but I'm not seeing a corresponding fix.

https://github.com/maxmind/geoip-api-c/issues?q=is%3Aissue+is%3Aclosed
Comment 14 Greg Oschwald 2015-01-13 10:08:31 EST
I am a developer at MaxMind. Although I cannot find this particular report in our bug tracker, I believe this issue was fixed in 1.5.1. In particular, I think this commit fixed the issue:

https://github.com/maxmind/geoip-api-c/commit/da5bf328950ecf1dd7a219d92e74c41de9b34513

I attempted to run the attached C file and it was unable to open the file in all modes.
Comment 15 Paul Howarth 2015-01-13 11:11:49 EST
As all current Fedora releases have version 1.5.1, I think we can close this one. Florian, do you agree?

Thanks for the info Greg. Perhaps you could take a look at Bug #1180874, in which the geoiplookup tool segfaults when pointed to a corrupt file, in this case a .csv file rather than an actual database file? I was able to reproduce the crash using the csv file from https://github.com/mlsecproject/combine/blob/master/data/GeoIPASNum2.csv

$ geoiplookup -f GeoIPASNum2.csv 69.55.48.0
Error Traversing Database for ipnum = 1161244672 - Perhaps database is corrupt?
Segmentation fault (core dumped)
Comment 16 Florian Weimer 2015-01-14 09:30:22 EST
(In reply to Greg Oschwald from comment #14)
> I am a developer at MaxMind. Although I cannot find this particular report
> in our bug tracker, I believe this issue was fixed in 1.5.1. In particular,
> I think this commit fixed the issue:
> 
> https://github.com/maxmind/geoip-api-c/commit/
> da5bf328950ecf1dd7a219d92e74c41de9b34513

This commit is definitely related to this bug.  I'm a bit worried that this commit does not address the overflow in the multiplication (which may be harmless).  It's also unclear what happens with a 32-bit off_t.  It's usually defined as long, so it has higher integer conversion rank than unsigned int, and the comparison will be signed, which is clearly not what is intended here.
Comment 17 Greg Oschwald 2015-02-02 12:43:14 EST
We believe the changes in this commit address the lingering concerns:

https://github.com/maxmind/geoip-api-c/commit/4cbca3afbea0e88bd41536a2d27e0aba21d4523a

This will be in our next release.
Comment 18 Fedora Update System 2015-04-14 03:57:48 EDT
GeoIP-GeoLite-data-2015.04-1.el5,geoipupdate-2.2.1-2.el5,GeoIP-1.6.5-1.el5 has been submitted as an update for Fedora EPEL 5.
https://admin.fedoraproject.org/updates/GeoIP-GeoLite-data-2015.04-1.el5,geoipupdate-2.2.1-2.el5,GeoIP-1.6.5-1.el5
Comment 19 Fedora Update System 2015-04-14 03:59:11 EDT
GeoIP-GeoLite-data-2015.04-1.el6,geoipupdate-2.2.1-2.el6,GeoIP-1.6.5-1.el6 has been submitted as an update for Fedora EPEL 6.
https://admin.fedoraproject.org/updates/GeoIP-GeoLite-data-2015.04-1.el6,geoipupdate-2.2.1-2.el6,GeoIP-1.6.5-1.el6
Comment 20 Fedora Update System 2015-04-14 04:00:30 EDT
GeoIP-GeoLite-data-2015.04-1.fc21,geoipupdate-2.2.1-2.fc21,GeoIP-1.6.5-1.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/GeoIP-GeoLite-data-2015.04-1.fc21,geoipupdate-2.2.1-2.fc21,GeoIP-1.6.5-1.fc21
Comment 21 Fedora Update System 2015-04-14 04:00:47 EDT
GeoIP-GeoLite-data-2015.04-1.fc22,geoipupdate-2.2.1-2.fc22,GeoIP-1.6.5-1.fc22 has been submitted as an update for Fedora 22.
https://admin.fedoraproject.org/updates/GeoIP-GeoLite-data-2015.04-1.fc22,geoipupdate-2.2.1-2.fc22,GeoIP-1.6.5-1.fc22
Comment 22 Fedora Update System 2015-04-14 04:03:10 EDT
GeoIP-GeoLite-data-2015.04-1.fc20,geoipupdate-2.2.1-2.fc20,GeoIP-1.6.5-1.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/GeoIP-GeoLite-data-2015.04-1.fc20,geoipupdate-2.2.1-2.fc20,GeoIP-1.6.5-1.fc20
Comment 23 Paul Howarth 2015-04-14 10:39:01 EDT
I've built updates to GeoIP 1.6.5 for all current Fedora releases, plus EPEL-5 and EPEL-6, which should address this.

However, EL-7 ships with GeoIP 1.5.0 so it still may be an issue there.
Comment 24 Fedora Update System 2015-04-21 15:15:01 EDT
GeoIP-GeoLite-data-2015.04-1.fc22, geoipupdate-2.2.1-2.fc22, GeoIP-1.6.5-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 25 Fedora Update System 2015-04-26 08:48:30 EDT
GeoIP-GeoLite-data-2015.04-1.fc20, geoipupdate-2.2.1-2.fc20, GeoIP-1.6.5-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 26 Fedora Update System 2015-04-26 08:58:39 EDT
GeoIP-GeoLite-data-2015.04-1.fc21, geoipupdate-2.2.1-2.fc21, GeoIP-1.6.5-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 27 Fedora Update System 2015-05-14 02:27:52 EDT
geoipupdate-2.2.1-2.el6, GeoIP-1.6.5-1.el6, GeoIP-GeoLite-data-2015.04-2.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 28 Fedora Update System 2015-05-14 02:28:38 EDT
geoipupdate-2.2.1-2.el5, GeoIP-GeoLite-data-2015.04-2.el5, GeoIP-1.6.5-2.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.