Hide Forgot
A memory leak was found in the way rsyslog system log deamon processed log messages when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could use this flaw to cause denial of the rsyslogd daemon service (excessive memory use and potential abort) via a log message, belonging to more than one ruleset. References: [1] http://bugzilla.adiscon.com/show_bug.cgi?id=226 [2] http://bugzilla.adiscon.com/show_bug.cgi?id=218 [3] http://www.openwall.com/lists/oss-security/2011/03/29/3 [4] http://www.openwall.com/lists/oss-security/2011/04/04/41 Upstream patch: [5] http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=1ef709cc97d54f74d3fdeb83788cc4b01f4c6a2a
Public PoC (from [1]): ====================== Repro: simple config: $ModLoad /home/rger/proj/rsyslog/plugins/imudp/.libs/imudp $ModLoad /home/rger/proj/rsyslog/plugins/imtcp/.libs/imtcp $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $Ruleset RemoteHostRule $InputTCPServerBindRuleset RemoteHostRule $InputTCPServerRun 10514 $UDPServerRun 10514 *.* /dev/null Note that when the BindRuleSet directive is removed, no memory leak occurs. run two traffic generators for a couple of seconds: $ ./tcpflood -t 172.19.3.27 -p 10514 -m 10000000000 -c4 -Y -d350 -es -Tudp -b10 -W1000 $ ./tcpflood -t 172.19.3.27 -p 10514 -m 10000000000 -c4 -Y -d350 -es
This issue did NOT affect the versions of the rsyslog package, as shipped with Red Hat Enterprise Linux 5 and 6. This issue did NOT affect the versions of the rsyslog package, as shipped with Fedora release of 13 and 14.
Statement: Not vulnerable. This issue did not affect the versions of rsyslog as shipped with Red Hat Enterprise Linux 5 and 6.