Bug 1605052 (CVE-2018-8011) - CVE-2018-8011 httpd: mod_md: NULL pointer dereference causing httpd child process crash
Summary: CVE-2018-8011 httpd: mod_md: NULL pointer dereference causing httpd child pro...
Alias: CVE-2018-8011
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1605093 1605094
Blocks: 1605053
TreeView+ depends on / blocked
Reported: 2018-07-20 04:56 UTC by Sam Fowler
Modified: 2021-02-16 23:56 UTC (History)
57 users (show)

Fixed In Version: httpd 2.4.34
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2019-06-10 10:33:44 UTC

Attachments (Terms of Use)
mod_md CVE-2018-8011 patch (974 bytes, patch)
2018-07-20 09:27 UTC, Joe Orton
no flags Details | Diff

Description Sam Fowler 2018-07-20 04:56:25 UTC
Apache httpd before version 2.4.34 has a vulnerability in mod_md. By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server.

External References:


Comment 1 Tomas Hoger 2018-07-20 07:32:23 UTC
The affected mod_md module was only introduced upstream in version 2.4.30 as an experimental module:

  *) mod_md: new experimental, module for managing domains across virtual hosts,
     implementing the Let's Encrypt ACMEv1 protocol to signup and renew 
     certificates. Please read the modules documentation for further instructions
     on how to use it. [Stefan Eissing]


Note that versions 2.4.30 and 2.4.31 were not released, so the first released version with this functionality was 2.4.32.

Comment 2 Tomas Hoger 2018-07-20 07:34:01 UTC
Created httpd tracking bugs for this issue:

Affects: fedora-all [bug 1605093]

Comment 5 Tomas Hoger 2018-07-20 09:07:04 UTC
This should be the patch, as applied to the mod_md git repo:


It notes the following fix for the mod_md 1.1.11:

  * fixes a Null Dereference when specially crafted requests are sent to the
    server. Reported by Daniel Caminada <daniel.caminada>.

However, that commit includes additional unrelated changes (from mod_md 1.1.12).  The relevant part should be the second and the third change to the mod_md.c file.

The fix integrated to httpd trunk via this commit:


The fix to the 2.4 branch was even combined with lot of other changes, updating mod_md from version 1.0.8 to 1.1.15:


Comment 6 Joe Orton 2018-07-20 09:27:05 UTC
Created attachment 1464893 [details]
mod_md CVE-2018-8011 patch

According to (previously private) discussion at security.org, the specific fix for the mod_md issue is as attached. I am making it public here for full disclosure.

Note You need to log in before you can comment on or make changes to this bug.