| Message ID | 20240502020121.3267018-1-carlos@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | [1/2] Document CVE-2024-33599, CVE-2024-33600, CVE-2024-33601, CVE-2024-33602 | expand |
On 2024-05-01 21:58, Carlos O'Donell wrote: > This commit adds advisory data for the above CVE(s). > --- > advisories/GLIBC-SA-2024-0005 | 22 ++++++++++++++++++++++ > advisories/GLIBC-SA-2024-0006 | 28 ++++++++++++++++++++++++++++ > advisories/GLIBC-SA-2024-0007 | 28 ++++++++++++++++++++++++++++ > advisories/GLIBC-SA-2024-0008 | 26 ++++++++++++++++++++++++++ > 4 files changed, 104 insertions(+) > create mode 100644 advisories/GLIBC-SA-2024-0005 > create mode 100644 advisories/GLIBC-SA-2024-0006 > create mode 100644 advisories/GLIBC-SA-2024-0007 > create mode 100644 advisories/GLIBC-SA-2024-0008 > > diff --git a/advisories/GLIBC-SA-2024-0005 b/advisories/GLIBC-SA-2024-0005 > new file mode 100644 > index 0000000000..9dc3ff8cf9 > --- /dev/null > +++ b/advisories/GLIBC-SA-2024-0005 > @@ -0,0 +1,22 @@ > +nscd: Stack-based buffer overflow in netgroup cache > + > +If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted > +by client requests then a subsequent client request for netgroup data > +may result in a stack-based buffer overflow. This flaw was introduced > +in glibc 2.15 when the cache was added to nscd. > + > +This vulnerability is only present the nscd binary. > + > +CVE-Id: CVE-2024-33599 > +Public-Date: 2024-04-23 > +Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) > +Fix-Commit: 69c58d5ef9f584ea198bd00f7964d364d0e6b921 (2.31-155) > +Fix-Commit: a77064893bfe8a701770e2f53a4d33805bc47a5a (2.32-141) > +Fix-Commit: 5c75001a96abcd50cbdb74df24c3f013188d076e (2.33-264) > +Fix-Commit: 52f73e5c4e29b14e79167272297977f360ae1e97 (2.34-460) > +Fix-Commit: 7a95873543ce225376faf13bb71c43dea6d24f86 (2.35-316) > +Fix-Commit: caa3151ca460bdd9330adeedd68c3112d97bffe4 (2.36-165) > +Fix-Commit: f75c298e747b2b8b41b1c2f551c011a52c41bfd1 (2.37-91) > +Fix-Commit: 5968aebb86164034b8f8421b4abab2f837a5bdaf (2.38-72) > +Fix-Commit: 1263d583d2e28afb8be53f8d6922f0842036f35d (2.39-35) > +Fix-Commit: 87801a8fd06db1d654eea3e4f7626ff476a9bdaa (2.40) > diff --git a/advisories/GLIBC-SA-2024-0006 b/advisories/GLIBC-SA-2024-0006 > new file mode 100644 > index 0000000000..7fd0367e10 > --- /dev/null > +++ b/advisories/GLIBC-SA-2024-0006 > @@ -0,0 +1,28 @@ > +nscd: Avoid null pointer crashes after notfound response > + > +If the Name Service Cache Daemon's (nscd) cache fails to add a not-found > +netgroup response to the cache, the client request can result in a null > +pointer dereference. This flaw was introduced in glibc 2.15 when the > +cache was added to nscd. > + > +This vulnerability is only present in the nscd binary. > + > +This vulnerability was fixed across two commits; both commits are > +required to correct the defect e.g. > +7835b00dbce53c3c87bbbb1754a95fb5e58187aa and > +b048a482f088e53144d26a61c390bed0210f49f2. Only the final commit in the > +branch is listed in the fixed commit list. In this case, both commits should get listed, i.e. you'll have 2 commits per release branch. > + > +CVE-Id: CVE-2024-33600 > +Public-Date: 2024-04-24 > +Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) > +Fix-Commit: b048a482f088e53144d26a61c390bed0210f49f2 (2.40) > +Fix-Commit: c99f886de54446cd4447db6b44be93dabbdc2f8b (2.39-37) > +Fix-Commit: 2ae9446c1b7a3064743b4a51c0bbae668ee43e4c (2.38-74) > +Fix-Commit: a8070b31043c7585c36ba68a74298c4f7af075c3 (2.37-93) > +Fix-Commit: f205b3af56740e3b014915b1bd3b162afe3407ef (2.36-167) > +Fix-Commit: bafadc589fbe21ae330e8c2af74db9da44a17660 (2.35-318) > +Fix-Commit: 1f94122289a9bf7dba573f5d60327aaa2b85cf2e (2.34-462) > +Fix-Commit: e3eef1b8fbdd3a7917af466ca9c4b7477251ca79 (2.33-266) > +Fix-Commit: be602180146de37582a3da3a0caa4b719645de9c (2.32-143) > +Fix-Commit: 8d7949183760170c61e55def723c1d8050187874 (2.31-157) > diff --git a/advisories/GLIBC-SA-2024-0007 b/advisories/GLIBC-SA-2024-0007 > new file mode 100644 > index 0000000000..d4f5d4298c > --- /dev/null > +++ b/advisories/GLIBC-SA-2024-0007 > @@ -0,0 +1,28 @@ > +nscd: netgroup cache may terminate daemon on memory allocation failure > + > +The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or > +xrealloc and these functions may terminate the process due to a memory > +allocation failure resulting in a denial of service to the clients. The > +flaw was introduced in glibc 2.15 when the cache was added to nscd. > + > +This vulnerability is only present the nscd binary. > + > +Subsequent refactoring of the netgroup cache only added more uses of > +xmalloc and xrealloc. Uses of xmalloc and xrealloc in other parts of > +nscd only occur during startup of the daemon and so are not affected by > +client requests that could trigger an out of memory followed by > +termination. > + > +CVE-Id: CVE-2024-33601 > +Public-Date: 2024-04-24 > +Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) > +Fix-Commit: c04a21e050d64a1193a6daab872bca2528bda44b (2.40) > +Fix-Commit: a9a8d3eebb145779a18d90e3966009a1daa63cd8 (2.39-38) > +Fix-Commit: 71af8ca864345d39b746d5cee84b94b430fad5db (2.38-75) > +Fix-Commit: 6e106dc214d6a033a4e945d1c6cf58061f1c5f1f (2.37-94) > +Fix-Commit: b6742463694b1dfdd5120b91ee21cf05d15ec2e2 (2.36-168) > +Fix-Commit: 7a5864cac60e06000394128a5a2817b03542f5a3 (2.35-319) > +Fix-Commit: 86f1d5f4129c373ac6fb6df5bcf38273838843cb (2.34-463) > +Fix-Commit: 4d27d4b9a188786fc6a56745506cec2acfc51f83 (2.33-267) > +Fix-Commit: 3ed195a8ec89da281e3c4bf887a13d281b72d8f4 (2.32-144) > +Fix-Commit: bbf5a58ccb55679217f94de706164d15372fbbc0 (2.31-158) > diff --git a/advisories/GLIBC-SA-2024-0008 b/advisories/GLIBC-SA-2024-0008 > new file mode 100644 > index 0000000000..60c0187b76 > --- /dev/null > +++ b/advisories/GLIBC-SA-2024-0008 > @@ -0,0 +1,26 @@ > +nscd: netgroup cache assumes NSS callback uses in-buffer strings > + > +The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory > +when the NSS callback does not store all strings in the provided buffer. > +The flaw was introduced in glibc 2.15 when the cache was added to nscd. > + > +This vulnerability is only present the nscd binary. > + > +There is no guarantee from the NSS callback API that the returned > +strings are all within the buffer. However, the netgroup cache code > +assumes that the NSS callback uses in-buffer strings and if it doesn't > +the buffer resizing logic could lead to potential memory corruption. > + > +CVE-Id: CVE-2024-33602 > +Public-Date: 2024-04-24 > +Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) > +Fix-Commit: c04a21e050d64a1193a6daab872bca2528bda44b (2.40) > +Fix-Commit: a9a8d3eebb145779a18d90e3966009a1daa63cd8 (2.39-38) > +Fix-Commit: 71af8ca864345d39b746d5cee84b94b430fad5db (2.38-75) > +Fix-Commit: 6e106dc214d6a033a4e945d1c6cf58061f1c5f1f (2.37-94) > +Fix-Commit: b6742463694b1dfdd5120b91ee21cf05d15ec2e2 (2.36-168) > +Fix-Commit: 7a5864cac60e06000394128a5a2817b03542f5a3 (2.35-319) > +Fix-Commit: 86f1d5f4129c373ac6fb6df5bcf38273838843cb (2.34-463) > +Fix-Commit: 4d27d4b9a188786fc6a56745506cec2acfc51f83 (2.33-267) > +Fix-Commit: 3ed195a8ec89da281e3c4bf887a13d281b72d8f4 (2.32-144) > +Fix-Commit: bbf5a58ccb55679217f94de706164d15372fbbc0 (2.31-158)
On 5/2/24 06:38, Siddhesh Poyarekar wrote: >> +This vulnerability was fixed across two commits; both commits are >> +required to correct the defect e.g. >> +7835b00dbce53c3c87bbbb1754a95fb5e58187aa and >> +b048a482f088e53144d26a61c390bed0210f49f2. Only the final commit in the >> +branch is listed in the fixed commit list. > > In this case, both commits should get listed, i.e. you'll have 2 commits per release branch. Thanks, I missed that note in the advisories/README about this. Fixed in v2: https://patchwork.sourceware.org/project/glibc/patch/20240502201423.3413078-1-carlos@redhat.com/
diff --git a/advisories/GLIBC-SA-2024-0005 b/advisories/GLIBC-SA-2024-0005 new file mode 100644 index 0000000000..9dc3ff8cf9 --- /dev/null +++ b/advisories/GLIBC-SA-2024-0005 @@ -0,0 +1,22 @@ +nscd: Stack-based buffer overflow in netgroup cache + +If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted +by client requests then a subsequent client request for netgroup data +may result in a stack-based buffer overflow. This flaw was introduced +in glibc 2.15 when the cache was added to nscd. + +This vulnerability is only present the nscd binary. + +CVE-Id: CVE-2024-33599 +Public-Date: 2024-04-23 +Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) +Fix-Commit: 69c58d5ef9f584ea198bd00f7964d364d0e6b921 (2.31-155) +Fix-Commit: a77064893bfe8a701770e2f53a4d33805bc47a5a (2.32-141) +Fix-Commit: 5c75001a96abcd50cbdb74df24c3f013188d076e (2.33-264) +Fix-Commit: 52f73e5c4e29b14e79167272297977f360ae1e97 (2.34-460) +Fix-Commit: 7a95873543ce225376faf13bb71c43dea6d24f86 (2.35-316) +Fix-Commit: caa3151ca460bdd9330adeedd68c3112d97bffe4 (2.36-165) +Fix-Commit: f75c298e747b2b8b41b1c2f551c011a52c41bfd1 (2.37-91) +Fix-Commit: 5968aebb86164034b8f8421b4abab2f837a5bdaf (2.38-72) +Fix-Commit: 1263d583d2e28afb8be53f8d6922f0842036f35d (2.39-35) +Fix-Commit: 87801a8fd06db1d654eea3e4f7626ff476a9bdaa (2.40) diff --git a/advisories/GLIBC-SA-2024-0006 b/advisories/GLIBC-SA-2024-0006 new file mode 100644 index 0000000000..7fd0367e10 --- /dev/null +++ b/advisories/GLIBC-SA-2024-0006 @@ -0,0 +1,28 @@ +nscd: Avoid null pointer crashes after notfound response + +If the Name Service Cache Daemon's (nscd) cache fails to add a not-found +netgroup response to the cache, the client request can result in a null +pointer dereference. This flaw was introduced in glibc 2.15 when the +cache was added to nscd. + +This vulnerability is only present in the nscd binary. + +This vulnerability was fixed across two commits; both commits are +required to correct the defect e.g. +7835b00dbce53c3c87bbbb1754a95fb5e58187aa and +b048a482f088e53144d26a61c390bed0210f49f2. Only the final commit in the +branch is listed in the fixed commit list. + +CVE-Id: CVE-2024-33600 +Public-Date: 2024-04-24 +Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) +Fix-Commit: b048a482f088e53144d26a61c390bed0210f49f2 (2.40) +Fix-Commit: c99f886de54446cd4447db6b44be93dabbdc2f8b (2.39-37) +Fix-Commit: 2ae9446c1b7a3064743b4a51c0bbae668ee43e4c (2.38-74) +Fix-Commit: a8070b31043c7585c36ba68a74298c4f7af075c3 (2.37-93) +Fix-Commit: f205b3af56740e3b014915b1bd3b162afe3407ef (2.36-167) +Fix-Commit: bafadc589fbe21ae330e8c2af74db9da44a17660 (2.35-318) +Fix-Commit: 1f94122289a9bf7dba573f5d60327aaa2b85cf2e (2.34-462) +Fix-Commit: e3eef1b8fbdd3a7917af466ca9c4b7477251ca79 (2.33-266) +Fix-Commit: be602180146de37582a3da3a0caa4b719645de9c (2.32-143) +Fix-Commit: 8d7949183760170c61e55def723c1d8050187874 (2.31-157) diff --git a/advisories/GLIBC-SA-2024-0007 b/advisories/GLIBC-SA-2024-0007 new file mode 100644 index 0000000000..d4f5d4298c --- /dev/null +++ b/advisories/GLIBC-SA-2024-0007 @@ -0,0 +1,28 @@ +nscd: netgroup cache may terminate daemon on memory allocation failure + +The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or +xrealloc and these functions may terminate the process due to a memory +allocation failure resulting in a denial of service to the clients. The +flaw was introduced in glibc 2.15 when the cache was added to nscd. + +This vulnerability is only present the nscd binary. + +Subsequent refactoring of the netgroup cache only added more uses of +xmalloc and xrealloc. Uses of xmalloc and xrealloc in other parts of +nscd only occur during startup of the daemon and so are not affected by +client requests that could trigger an out of memory followed by +termination. + +CVE-Id: CVE-2024-33601 +Public-Date: 2024-04-24 +Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) +Fix-Commit: c04a21e050d64a1193a6daab872bca2528bda44b (2.40) +Fix-Commit: a9a8d3eebb145779a18d90e3966009a1daa63cd8 (2.39-38) +Fix-Commit: 71af8ca864345d39b746d5cee84b94b430fad5db (2.38-75) +Fix-Commit: 6e106dc214d6a033a4e945d1c6cf58061f1c5f1f (2.37-94) +Fix-Commit: b6742463694b1dfdd5120b91ee21cf05d15ec2e2 (2.36-168) +Fix-Commit: 7a5864cac60e06000394128a5a2817b03542f5a3 (2.35-319) +Fix-Commit: 86f1d5f4129c373ac6fb6df5bcf38273838843cb (2.34-463) +Fix-Commit: 4d27d4b9a188786fc6a56745506cec2acfc51f83 (2.33-267) +Fix-Commit: 3ed195a8ec89da281e3c4bf887a13d281b72d8f4 (2.32-144) +Fix-Commit: bbf5a58ccb55679217f94de706164d15372fbbc0 (2.31-158) diff --git a/advisories/GLIBC-SA-2024-0008 b/advisories/GLIBC-SA-2024-0008 new file mode 100644 index 0000000000..60c0187b76 --- /dev/null +++ b/advisories/GLIBC-SA-2024-0008 @@ -0,0 +1,26 @@ +nscd: netgroup cache assumes NSS callback uses in-buffer strings + +The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory +when the NSS callback does not store all strings in the provided buffer. +The flaw was introduced in glibc 2.15 when the cache was added to nscd. + +This vulnerability is only present the nscd binary. + +There is no guarantee from the NSS callback API that the returned +strings are all within the buffer. However, the netgroup cache code +assumes that the NSS callback uses in-buffer strings and if it doesn't +the buffer resizing logic could lead to potential memory corruption. + +CVE-Id: CVE-2024-33602 +Public-Date: 2024-04-24 +Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) +Fix-Commit: c04a21e050d64a1193a6daab872bca2528bda44b (2.40) +Fix-Commit: a9a8d3eebb145779a18d90e3966009a1daa63cd8 (2.39-38) +Fix-Commit: 71af8ca864345d39b746d5cee84b94b430fad5db (2.38-75) +Fix-Commit: 6e106dc214d6a033a4e945d1c6cf58061f1c5f1f (2.37-94) +Fix-Commit: b6742463694b1dfdd5120b91ee21cf05d15ec2e2 (2.36-168) +Fix-Commit: 7a5864cac60e06000394128a5a2817b03542f5a3 (2.35-319) +Fix-Commit: 86f1d5f4129c373ac6fb6df5bcf38273838843cb (2.34-463) +Fix-Commit: 4d27d4b9a188786fc6a56745506cec2acfc51f83 (2.33-267) +Fix-Commit: 3ed195a8ec89da281e3c4bf887a13d281b72d8f4 (2.32-144) +Fix-Commit: bbf5a58ccb55679217f94de706164d15372fbbc0 (2.31-158)