Bug 841183 - Missing namelen check in __pmDecodeFetch
Summary: Missing namelen check in __pmDecodeFetch
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: pcp   
(Show other bugs)
Version: 16
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Nathan Scott
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Keywords: Security
Depends On:
Blocks: 840765 CVE-2012-3418
TreeView+ depends on / blocked
 
Reported: 2012-07-18 11:19 UTC by Florian Weimer
Modified: 2012-08-20 03:54 UTC (History)
4 users (show)

Fixed In Version: pcp-3.6.5
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-08-20 03:54:06 UTC
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Resolve issues in decoding PCP fetch PDUs (1.27 KB, patch)
2012-07-23 01:01 UTC, Nathan Scott
no flags Details | Diff
Updated patch to address PCP fetch PDU decoding issues (1.36 KB, patch)
2012-07-24 02:40 UTC, Nathan Scott
no flags Details | Diff

Description Florian Weimer 2012-07-18 11:19:55 UTC
pmcd crashes when processing a crafted PDU_FETCH request because of a missing length check in __pmDecodeFetch.  Code execution through this bug appears unlikely because the loop which runs past the end of the PDU only performs byte swapping (on little-endian architectures).

Comment 2 Mark Goodwin 2012-07-22 23:45:42 UTC
Nathan requested assignment, thanks Nathan.

Comment 3 Nathan Scott 2012-07-23 01:01:47 UTC
Created attachment 599665 [details]
Resolve issues in decoding PCP fetch PDUs

Proposed fix attached.  Please review, thanks.

Comment 4 Florian Weimer 2012-07-23 11:38:01 UTC
(In reply to comment #3)
> Created attachment 599665 [details]
> Resolve issues in decoding PCP fetch PDUs
> 
> Proposed fix attached.  Please review, thanks.

    if ((pduend - (char*)pp) != sizeof(fetch_t) + ((sizeof(pmID)) * (numpmid-1)))

The expression (sizeof(pmID)) * (numpmid-1) can overflow (for instance, if numpmid is 0x40000001), so the check does not catch all cases where numpmid and the actual number of elements disagree.

Comment 5 Nathan Scott 2012-07-24 02:40:10 UTC
Created attachment 599891 [details]
Updated patch to address PCP fetch PDU decoding issues

Comment 6 Huzaifa S. Sidhpurwala 2012-08-16 03:53:43 UTC
Upstream patch:

http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git;a=commit;h=7eb479b91ef12bf89a15b078af2107c8c4746a4a

This issue has been addressed in pcp-3.6.5


Note You need to log in before you can comment on or make changes to this bug.