[Bug nss/30626] New: Empty passwd service line causes getpwuid() to crash (SEGV)

[Bug nss/30626] New: Empty passwd service line causes getpwuid() to crash (SEGV)

[gjduck at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30626

            Bug ID: 30626
           Summary: Empty passwd service line causes getpwuid() to crash
                    (SEGV)
           Product: glibc
           Version: 2.37
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: nss
          Assignee: unassigned at sourceware dot org
          Reporter: gjduck at gmail dot com
  Target Milestone: ---

Created attachment 14960
  --> https://sourceware.org/bugzilla/attachment.cgi?id=14960&action=edit
getpwuid.c

Configuring "passwd" with an empty service line seems to cause getpwuid() to
crash:

    __nss_configure_lookup("passwd", "");
    struct passwd *pw = getpwuid(uid);   // <---- SEGV

See the attached PoC, tested with glibc-2.37 (latest dev head) on Ubuntu 23.04.
 The steps to reproduce:

    $ gcc -o getpwuid getpwuid.c
    $ ./getpwuid
    Segmentation fault

The same bug also can be induced by udpating "passwd" in /etc/nsswitch.conf
with an empty service line:

    # /etc/nsswitch.conf
    ...
    passwd:

However, testing using this method risks bricking your system.

-- 
You are receiving this mail because:
You are on the CC list for the bug.