76 lines
2.3 KiB
Diff
76 lines
2.3 KiB
Diff
From ce6ba630dbc96f49eb1f30366aa62261df4792f9 Mon Sep 17 00:00:00 2001
|
||
From: Florian Weimer <fweimer@redhat.com>
|
||
Date: Tue, 27 Nov 2018 16:12:43 +0100
|
||
Subject: [PATCH 49] CVE-2018-19591: if_nametoindex: Fix descriptor for
|
||
overlong name [BZ #23927]
|
||
|
||
(cherry picked from commit d527c860f5a3f0ed687bd03f0cb464612dc23408)
|
||
---
|
||
ChangeLog | 7 +++++++
|
||
NEWS | 6 ++++++
|
||
sysdeps/unix/sysv/linux/if_index.c | 11 ++++++-----
|
||
3 files changed, 19 insertions(+), 5 deletions(-)
|
||
|
||
diff --git a/ChangeLog b/ChangeLog
|
||
index 8c92ee7764..a997003664 100644
|
||
--- a/ChangeLog
|
||
+++ b/ChangeLog
|
||
@@ -1,3 +1,10 @@
|
||
+2018-11-27 Florian Weimer <fweimer@redhat.com>
|
||
+
|
||
+ [BZ #23927]
|
||
+ CVE-2018-19591
|
||
+ * sysdeps/unix/sysv/linux/if_index.c (__if_nametoindex): Avoid
|
||
+ descriptor leak in case of ENODEV error.
|
||
+
|
||
2018-11-19 Florian Weimer <fweimer@redhat.com>
|
||
|
||
support: Print timestamps in timeout handler.
|
||
diff --git a/NEWS b/NEWS
|
||
index e5ca5903ec..5290e21da9 100644
|
||
--- a/NEWS
|
||
+++ b/NEWS
|
||
@@ -25,7 +25,13 @@ The following bugs are resolved with this release:
|
||
[23717] Fix stack overflow in stdlib/tst-setcontext9
|
||
[23821] si_band in siginfo_t has wrong type long int on sparc64
|
||
[23822] ia64 static libm.a is missing exp2f, log2f and powf symbols
|
||
+ [23927] Linux if_nametoindex() does not close descriptor (CVE-2018-19591)
|
||
|
||
+Security related changes:
|
||
+
|
||
+ CVE-2018-19591: A file descriptor leak in if_nametoindex can lead to a
|
||
+ denial of service due to resource exhaustion when processing getaddrinfo
|
||
+ calls with crafted host names. Reported by Guido Vranken.
|
||
|
||
Version 2.28
|
||
|
||
diff --git a/sysdeps/unix/sysv/linux/if_index.c b/sysdeps/unix/sysv/linux/if_index.c
|
||
index e3d08982d9..782fc5e175 100644
|
||
--- a/sysdeps/unix/sysv/linux/if_index.c
|
||
+++ b/sysdeps/unix/sysv/linux/if_index.c
|
||
@@ -38,11 +38,6 @@ __if_nametoindex (const char *ifname)
|
||
return 0;
|
||
#else
|
||
struct ifreq ifr;
|
||
- int fd = __opensock ();
|
||
-
|
||
- if (fd < 0)
|
||
- return 0;
|
||
-
|
||
if (strlen (ifname) >= IFNAMSIZ)
|
||
{
|
||
__set_errno (ENODEV);
|
||
@@ -50,6 +45,12 @@ __if_nametoindex (const char *ifname)
|
||
}
|
||
|
||
strncpy (ifr.ifr_name, ifname, sizeof (ifr.ifr_name));
|
||
+
|
||
+ int fd = __opensock ();
|
||
+
|
||
+ if (fd < 0)
|
||
+ return 0;
|
||
+
|
||
if (__ioctl (fd, SIOCGIFINDEX, &ifr) < 0)
|
||
{
|
||
int saved_errno = errno;
|
||
|