diff options
Diffstat (limited to 'backport-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-netgroup-cache.patch')
| -rw-r--r-- | backport-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-netgroup-cache.patch | 41 |
1 files changed, 41 insertions, 0 deletions
diff --git a/backport-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-netgroup-cache.patch b/backport-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-netgroup-cache.patch new file mode 100644 index 0000000..11b04f6 --- /dev/null +++ b/backport-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-netgroup-cache.patch @@ -0,0 +1,41 @@ +From 87801a8fd06db1d654eea3e4f7626ff476a9bdaa Mon Sep 17 00:00:00 2001 +From: Florian Weimer <fweimer@redhat.com> +Date: Thu, 25 Apr 2024 15:00:45 +0200 +Subject: [PATCH] CVE-2024-33599: nscd: Stack-based buffer overflow in netgroup + cache (bug 31677) + +Using alloca matches what other caches do. The request length is +bounded by MAXKEYLEN. + +Reviewed-by: Carlos O'Donell <carlos@redhat.com> + +Conflict:NA +Reference:https://sourceware.org/git/?p=glibc.git;a=patch;h=87801a8fd06db1d654eea3e4f7626ff476a9bdaa + +--- + nscd/netgroupcache.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c +index 2f71bf29..f13a11b4 100644 +--- a/nscd/netgroupcache.c ++++ b/nscd/netgroupcache.c +@@ -503,12 +503,13 @@ addinnetgrX (struct database_dyn *db, int fd, request_header *req, + = (struct indataset *) mempool_alloc (db, + sizeof (*dataset) + req->key_len, + 1); +- struct indataset dataset_mem; + bool cacheable = true; + if (__glibc_unlikely (dataset == NULL)) + { + cacheable = false; +- dataset = &dataset_mem; ++ /* The alloca is safe because nscd_run_worker verfies that ++ key_len is not larger than MAXKEYLEN. */ ++ dataset = alloca (sizeof (*dataset) + req->key_len); + } + + datahead_init_pos (&dataset->head, sizeof (*dataset) + req->key_len, +-- +2.33.0 + |