This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours
Bug 841183 - Missing namelen check in __pmDecodeFetch
Missing namelen check in __pmDecodeFetch
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: pcp (Show other bugs)
16
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Nathan Scott
Fedora Extras Quality Assurance
: Security
Depends On:
Blocks: 840765 CVE-2012-3418
  Show dependency treegraph
 
Reported: 2012-07-18 07:19 EDT by Florian Weimer
Modified: 2012-08-19 23:54 EDT (History)
4 users (show)

See Also:
Fixed In Version: pcp-3.6.5
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-08-19 23:54:06 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
Resolve issues in decoding PCP fetch PDUs (1.27 KB, patch)
2012-07-22 21:01 EDT, Nathan Scott
no flags Details | Diff
Updated patch to address PCP fetch PDU decoding issues (1.36 KB, patch)
2012-07-23 22:40 EDT, Nathan Scott
no flags Details | Diff

  None (edit)
Description Florian Weimer 2012-07-18 07:19:55 EDT
pmcd crashes when processing a crafted PDU_FETCH request because of a missing length check in __pmDecodeFetch.  Code execution through this bug appears unlikely because the loop which runs past the end of the PDU only performs byte swapping (on little-endian architectures).
Comment 2 Mark Goodwin 2012-07-22 19:45:42 EDT
Nathan requested assignment, thanks Nathan.
Comment 3 Nathan Scott 2012-07-22 21:01:47 EDT
Created attachment 599665 [details]
Resolve issues in decoding PCP fetch PDUs

Proposed fix attached.  Please review, thanks.
Comment 4 Florian Weimer 2012-07-23 07:38:01 EDT
(In reply to comment #3)
> Created attachment 599665 [details]
> Resolve issues in decoding PCP fetch PDUs
> 
> Proposed fix attached.  Please review, thanks.

    if ((pduend - (char*)pp) != sizeof(fetch_t) + ((sizeof(pmID)) * (numpmid-1)))

The expression (sizeof(pmID)) * (numpmid-1) can overflow (for instance, if numpmid is 0x40000001), so the check does not catch all cases where numpmid and the actual number of elements disagree.
Comment 5 Nathan Scott 2012-07-23 22:40:10 EDT
Created attachment 599891 [details]
Updated patch to address PCP fetch PDU decoding issues
Comment 6 Huzaifa S. Sidhpurwala 2012-08-15 23:53:43 EDT
Upstream patch:

http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git;a=commit;h=7eb479b91ef12bf89a15b078af2107c8c4746a4a

This issue has been addressed in pcp-3.6.5

Note You need to log in before you can comment on or make changes to this bug.