Bug 848748 - Malformed xdr request causes reading uninitialize memory and can cause huge memory leaks
Summary: Malformed xdr request causes reading uninitialize memory and can cause huge m...
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: glibc
Version: 6.4
Hardware: Unspecified
OS: Linux
unspecified
high
Target Milestone: rc
: ---
Assignee: Patsy Franklin
QA Contact: Arjun Shankar
URL:
Whiteboard:
Keywords:
Depends On: 892777
Blocks: 845283 852661
TreeView+ depends on / blocked
 
Reported: 2012-08-16 10:55 UTC by Honza Horak
Modified: 2016-11-24 15:48 UTC (History)
6 users (show)

(edit)
A defect in the library made it possible for a corrupt NIS request to cause the library to allocate unbounded amounts of memory and eventually crash. The library has been fixed to limit the size of NIS records to at most 16MB and no longer crashes when processing corrupt NIS requests. It is possible that some configurations with very large NIS maps may no longer work if those maps exceed the new NIS record maximum of 16MB.
Clone Of:
(edit)
Last Closed: 2013-11-21 10:39:57 UTC


Attachments (Terms of Use)
malformed request that can cause huge memory allocations (97 bytes, application/octet-stream)
2012-08-16 11:00 UTC, Honza Horak
no flags Details
proposed patch that uses sane limits while parsing xdr request (1.31 KB, patch)
2012-08-16 11:01 UTC, Honza Horak
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:1605 normal SHIPPED_LIVE Moderate: glibc security, bug fix, and enhancement update 2013-11-20 21:54:09 UTC

Description Honza Horak 2012-08-16 10:55:47 UTC
Description of problem:
This issue has been found during analysing of bug #845283.

Let's have NIS client and server configured. glibc's functions like yp_match then send UDP packets to NIS server to ask for network information like login names, passwords etc. Requests are byte strings containing e.g. "...<domainname length><domainname string>...".

When we change length field of the xdr request, while the rest of the string is unchanged and pass such malformed request to the ypserv daemon for example, glibc routine allocates huge memory and then tries to read huge amount of such unallocated memory.

ypserv has a bug #845283, that causes not freeing memory when request is not parsed properly, which results in huge memory leaks and daemon failure. While freeing memory after failed parsing has to be fixed in ypserv, glibc should prevent such behaviour and not allocate more memory than necessary to avoid reading unallocated memory.

There are already limits for NIS fields like domainname, mapname, etc., but they're not used in the parsing functions. Valgrind prints then the following error:

==16566== Conditional jump or move depends on uninitialised value(s)
==16566==    at 0x4A077F9: __GI_strlen (mc_replace_strmem.c:284)
==16566==    by 0x51587F6: xdr_string (xdr.c:680)
==16566==    by 0x4E2D5AD: xdr_ypreq_key (yp_xdr.c:50)
==16566==    by 0x10B092: ypprog_2 (ypserv.c:222)
==16566==    by 0x5156398: svc_getreq_common (svc.c:485)
==16566==    by 0x5155ED0: svc_getreq_poll (svc.c:415)
==16566==    by 0x5156A02: svc_run (svc_run.c:94)
==16566==    by 0x10B84C: main (ypserv.c:726)

Using the following sane limits to NIS fields should prevent such behaviour:
#define YPMAXRECORD 1024
#define YPMAXDOMAIN 64
#define YPMAXMAP 64
#define YPMAXPEER 64


Version-Release number of selected component (if applicable):
glibc-2.12-1.80.el6.x86_64

How reproducible:
every-time

Steps to Reproduce:
1. start ypserv daemon
2. configure ypbind to use that ypserv daemon
3. create a malformed request string (example of such request will be attached as ypserv-packet-bin)
4. cat ypserv-packet-bin |nc -u 192.168.122.70 811 (192.168.122.70:811 is where ypserv listens for UDP requests)

  
Actual results:
huge amount of memory is allocated and then uninitialized memory is read during parsing request

Expected results:
amount of memory allocated during request parsing is limited to a sane amount

Comment 1 Honza Horak 2012-08-16 11:00:30 UTC
Created attachment 604885 [details]
malformed request that can cause huge memory allocations

Use this like this (having ypserv listening for UDP on 192.168.122.70:788:
cat ypserv-packet-bin |nc -u 192.168.122.70 788

Comment 2 Honza Horak 2012-08-16 11:01:44 UTC
Created attachment 604886 [details]
proposed patch that uses sane limits while parsing xdr request

Comment 14 Jeff Law 2012-10-01 21:37:28 UTC
Resetting flags for 6.5 consideration.

Comment 16 Jason Montleon 2013-01-08 19:53:34 UTC
This approach causes problems with the slapi-nis plugin in IPA.
https://bugzilla.redhat.com/show_bug.cgi?id=892777

Comment 18 Carlos O'Donell 2013-02-04 15:57:02 UTC
We'll be looking at this issue as part of the review process for the next release. We'll keep the issue updated.

Comment 23 errata-xmlrpc 2013-11-21 10:39:57 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-1605.html


Note You need to log in before you can comment on or make changes to this bug.