public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug nscd/27462] New: double-free in nscd
@ 2021-02-24  7:46 siddhesh at sourceware dot org
  2021-02-24 15:52 ` [Bug nscd/27462] double-free in nscd (CVE-2021-27645) siddhesh at sourceware dot org
                   ` (9 more replies)
  0 siblings, 10 replies; 11+ messages in thread
From: siddhesh at sourceware dot org @ 2021-02-24  7:46 UTC (permalink / raw)
  To: glibc-bugs

https://sourceware.org/bugzilla/show_bug.cgi?id=27462

            Bug ID: 27462
           Summary: double-free in nscd
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: nscd
          Assignee: unassigned at sourceware dot org
          Reporter: siddhesh at sourceware dot org
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---
             Flags: security+

The following upstream patch:

commit 745664bd798ec8fd50438605948eea594179fba1
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue Aug 28 13:19:27 2018 +0200

    nscd: Fix use-after-free in addgetnetgrentX [BZ #23520]

    addinnetgrX may use the heap-allocated buffer, so free the buffer
    in this function.

introduced a double free bug because reference to an already freed object may
escape into tofree.  The worst case impact is an nscd crash (and hence DoS) due
to the double free.  The freed object does not get used anywhere, so there's no
use-after-free.

Here's a potential (untested) fix proposed by Carlos O'Donell.


diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c
index dba6ceec1b..ad2daddafd 100644
--- a/nscd/netgroupcache.c
+++ b/nscd/netgroupcache.c
@@ -248,7 +248,7 @@ addgetnetgrentX (struct database_dyn *db, int fd,
request_header *req,
                                             : NULL);
                                    ndomain = (ndomain ? newbuf + ndomaindiff
                                               : NULL);
-                                   buffer = newbuf;
+                                   *tofreep = buffer = newbuf;
                                  }

                                nhost = memcpy (buffer + bufused,
@@ -319,7 +319,7 @@ addgetnetgrentX (struct database_dyn *db, int fd,
request_header *req,
                    else if (status == NSS_STATUS_TRYAGAIN && e == ERANGE)
                      {
                        buflen *= 2;
-                       buffer = xrealloc (buffer, buflen);
+                       *tofreep = buffer = xrealloc (buffer, buflen);
                      }
                    else if (status == NSS_STATUS_RETURN
                             || status == NSS_STATUS_NOTFOUND
---

-- 
You are receiving this mail because:
You are on the CC list for the bug.

^ permalink raw reply	[flat|nested] 11+ messages in thread
end of thread, other threads:[~2021-03-03  5:02 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-24  7:46 [Bug nscd/27462] New: double-free in nscd siddhesh at sourceware dot org
2021-02-24 15:52 ` [Bug nscd/27462] double-free in nscd (CVE-2021-27645) siddhesh at sourceware dot org
2021-02-24 19:16 ` sam at gentoo dot org
2021-02-24 20:22 ` carnil at debian dot org
2021-02-25  4:28 ` siddhesh at sourceware dot org
2021-02-25  4:30 ` siddhesh at sourceware dot org
2021-02-27  5:08 ` crushor at hotmail dot com
2021-02-27  5:43 ` dj at redhat dot com
2021-02-27  6:02 ` crushor at hotmail dot com
2021-03-01  2:22 ` siddhesh at sourceware dot org
2021-03-03  5:02 ` siddhesh at sourceware dot org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).