[Bug network/28768] New: Buffer overflow in svcunix_create with long pathnames

[Bug network/28768] New: Buffer overflow in svcunix_create with long pathnames

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=28768

            Bug ID: 28768
           Summary: Buffer overflow in svcunix_create with long pathnames
           Product: glibc
           Version: 2.34
            Status: NEW
          Severity: normal
          Priority: P2
         Component: network
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
  Target Milestone: ---
             Flags: security+

This is similar to bug 22542, but in different code:

SVCXPRT *
svcunix_create (int sock, u_int sendsize, u_int recvsize, char *path)
{
  bool_t madesock = FALSE;
  SVCXPRT *xprt;
  struct unix_rendezvous *r;
  struct sockaddr_un addr;
  socklen_t len = sizeof (struct sockaddr_in);

  if (sock == RPC_ANYSOCK)
    {
      if ((sock = __socket (AF_UNIX, SOCK_STREAM, 0)) < 0)
        {
          perror (_("svc_unix.c - AF_UNIX socket creation problem"));
          return (SVCXPRT *) NULL;
        }
      madesock = TRUE;
    }
  memset (&addr, '\0', sizeof (addr));
  addr.sun_family = AF_UNIX;
  len = strlen (path) + 1;
  memcpy (addr.sun_path, path, len);
  len += sizeof (addr.sun_family);
[…]

There is no length check, either.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/28768] Buffer overflow in svcunix_create with long pathnames

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=28768

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
           Assignee|unassigned at sourceware dot org   |fweimer at redhat dot com
             Status|NEW                         |ASSIGNED

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/28768] Buffer overflow in svcunix_create with long pathnames (CVE-2022-23218)

[siddhesh at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=28768

Siddhesh Poyarekar <siddhesh at sourceware dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |siddhesh at sourceware dot org
            Summary|Buffer overflow in          |Buffer overflow in
                   |svcunix_create with long    |svcunix_create with long
                   |pathnames                   |pathnames (CVE-2022-23218)
              Alias|                            |CVE-2022-23218

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/28768] Buffer overflow in svcunix_create with long pathnames (CVE-2022-23218)

[sam at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=28768

Sam James <sam at gentoo dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sam at gentoo dot org

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/28768] Buffer overflow in svcunix_create with long pathnames (CVE-2022-23218)

[aurelien at aurel32 dot net]

https://sourceware.org/bugzilla/show_bug.cgi?id=28768

Aurelien Jarno <aurelien at aurel32 dot net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aurelien at aurel32 dot net

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/28768] Buffer overflow in svcunix_create with long pathnames (CVE-2022-23218)

[pgowda.cve at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=28768

pgowda <pgowda.cve at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pgowda.cve at gmail dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/28768] Buffer overflow in svcunix_create with long pathnames (CVE-2022-23218)

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=28768

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |2.35
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #1 from Florian Weimer <fweimer at redhat dot com> ---
Fixed for glibc 2.35 via:

commit f545ad4928fa1f27a3075265182b38a4f939a5f7
Author: Florian Weimer <fweimer@redhat.com>
Date:   Mon Jan 17 10:21:34 2022 +0100

    CVE-2022-23218: Buffer overflow in sunrpc svcunix_create (bug 28768)

    The sunrpc function svcunix_create suffers from a stack-based buffer
    overflow with overlong pathname arguments.

    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>

-- 
You are receiving this mail because:
You are on the CC list for the bug.