From patchwork Tue Nov 27 15:05:16 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 1003873 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=sourceware.org (client-ip=209.132.180.131; helo=sourceware.org; envelope-from=libc-alpha-return-97579-incoming=patchwork.ozlabs.org@sourceware.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; secure) header.d=sourceware.org header.i=@sourceware.org header.b="yI9p37iz"; dkim-atps=neutral Received: from sourceware.org (server1.sourceware.org [209.132.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4346Xv1Vz2z9s4s for ; Wed, 28 Nov 2018 02:05:35 +1100 (AEDT) DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:subject:date:message-id:mime-version :content-type; q=dns; s=default; b=mbkSWnHIL4vfLX+0GJoN6beQfApMc Qwaroankjrwm3gSIjwKRdzS8j2CwvN9+RAOl5gHdXb64a54U2JgpcqfvTpGER1Rk jGSq/cJC3KqZXX0VYLKgAKupU0/lMSGiFeELPQC9RWYnkG0bP+yUilzlZbJYkO7s 0nm9b+WYCDv21c= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:subject:date:message-id:mime-version :content-type; s=default; bh=g8aJCZq0SXZktttFr327ocOnD9k=; b=yI9 p37izkZkxSAtbogg4gAZ/3eopWTqyfOIDg+GdC/7d29zBGj7hy6b3Fd+VanlT1Z1 0fCNyO42D9U/DoQXcPx6ZDRWO/GzlYyPR3thOfFxlByi8utFS+Bq6RAJR0uGcGWw 1nMvJSdX3e0UyZzmVzBiIehE0EcYGVmyvOPaPPVE= Received: (qmail 11387 invoked by alias); 27 Nov 2018 15:05:28 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 11359 invoked by uid 89); 27 Nov 2018 15:05:28 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-25.9 required=5.0 tests=BAYES_00, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, KAM_LAZY_DOMAIN_SECURITY, SPF_HELO_PASS autolearn=ham version=3.3.2 spammy=crafted, Close X-HELO: mx1.redhat.com From: Florian Weimer To: libc-alpha@sourceware.org Subject: [PATCH] CVE-2018-19591: if_nametoindex: Fix descriptor for overlong name [BZ #23927] Date: Tue, 27 Nov 2018 16:05:16 +0100 Message-ID: <87a7luh87n.fsf@oldenburg.str.redhat.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.3 (gnu/linux) MIME-Version: 1.0 We need to check the length of the string right before the strncpy call to avoid reintroducing the compiler warning from bug 22442. 2018-11-27 Florian Weimer [BZ #23927] CVE-2018-19591 * sysdeps/unix/sysv/linux/if_index.c (__if_nametoindex): Close descriptor in case of ENODEV error. diff --git a/NEWS b/NEWS index f488821af1..1098be1afb 100644 --- a/NEWS +++ b/NEWS @@ -57,7 +57,9 @@ Changes to build and runtime requirements: Security related changes: - [Add security related changes here] + CVE-2018-19591: A file descriptor leak in if_nametoindex can lead to a + denial of service due to resource exhaustion when processing getaddrinfo + calls with crafted host names. Reported by Guido Vranken. The following bugs are resolved with this release: diff --git a/sysdeps/unix/sysv/linux/if_index.c b/sysdeps/unix/sysv/linux/if_index.c index e3d08982d9..3e999d6509 100644 --- a/sysdeps/unix/sysv/linux/if_index.c +++ b/sysdeps/unix/sysv/linux/if_index.c @@ -45,6 +45,7 @@ __if_nametoindex (const char *ifname) if (strlen (ifname) >= IFNAMSIZ) { + __close_nocancel_nostatus (fd); __set_errno (ENODEV); return 0; }