77 lines
2.3 KiB
Diff
77 lines
2.3 KiB
Diff
|
From ce6ba630dbc96f49eb1f30366aa62261df4792f9 Mon Sep 17 00:00:00 2001
|
|||
|
|
From: Florian Weimer <fweimer@redhat.com>
|
|||
|
|
Date: Tue, 27 Nov 2018 16:12:43 +0100
|
|||
|
|
Subject: [PATCH 49] CVE-2018-19591: if_nametoindex: Fix descriptor for
|
|||
|
|
overlong name [BZ #23927]
|
|||
|
|
|
|||
|
|
(cherry picked from commit d527c860f5a3f0ed687bd03f0cb464612dc23408)
|
|||
|
|
---
|
|||
|
|
ChangeLog | 7 +++++++
|
|||
|
|
NEWS | 6 ++++++
|
|||
|
|
sysdeps/unix/sysv/linux/if_index.c | 11 ++++++-----
|
|||
|
|
3 files changed, 19 insertions(+), 5 deletions(-)
|
|||
|
|
|
|||
|
|
diff --git a/ChangeLog b/ChangeLog
|
|||
|
|
index 8c92ee7764..a997003664 100644
|
|||
|
|
--- a/ChangeLog
|
|||
|
|
+++ b/ChangeLog
|
|||
|
|
@@ -1,3 +1,10 @@
|
|||
|
|
+2018-11-27 Florian Weimer <fweimer@redhat.com>
|
|||
|
|
+
|
|||
|
|
+ [BZ #23927]
|
|||
|
|
+ CVE-2018-19591
|
|||
|
|
+ * sysdeps/unix/sysv/linux/if_index.c (__if_nametoindex): Avoid
|
|||
|
|
+ descriptor leak in case of ENODEV error.
|
|||
|
|
+
|
|||
|
|
2018-11-19 Florian Weimer <fweimer@redhat.com>
|
|||
|
|
|
|||
|
|
support: Print timestamps in timeout handler.
|
|||
|
|
diff --git a/NEWS b/NEWS
|
|||
|
|
index e5ca5903ec..5290e21da9 100644
|
|||
|
|
--- a/NEWS
|
|||
|
|
+++ b/NEWS
|
|||
|
|
@@ -25,7 +25,13 @@ The following bugs are resolved with this release:
|
|||
|
|
[23717] Fix stack overflow in stdlib/tst-setcontext9
|
|||
|
|
[23821] si_band in siginfo_t has wrong type long int on sparc64
|
|||
|
|
[23822] ia64 static libm.a is missing exp2f, log2f and powf symbols
|
|||
|
|
+ [23927] Linux if_nametoindex() does not close descriptor (CVE-2018-19591)
|
|||
|
|
|
|||
|
|
+Security related changes:
|
|||
|
|
+
|
|||
|
|
+ CVE-2018-19591: A file descriptor leak in if_nametoindex can lead to a
|
|||
|
|
+ denial of service due to resource exhaustion when processing getaddrinfo
|
|||
|
|
+ calls with crafted host names. Reported by Guido Vranken.
|
|||
|
|
|
|||
|
|
Version 2.28
|
|||
|
|
|
|||
|
|
diff --git a/sysdeps/unix/sysv/linux/if_index.c b/sysdeps/unix/sysv/linux/if_index.c
|
|||
|
|
index e3d08982d9..782fc5e175 100644
|
|||
|
|
--- a/sysdeps/unix/sysv/linux/if_index.c
|
|||
|
|
+++ b/sysdeps/unix/sysv/linux/if_index.c
|
|||
|
|
@@ -38,11 +38,6 @@ __if_nametoindex (const char *ifname)
|
|||
|
|
return 0;
|
|||
|
|
#else
|
|||
|
|
struct ifreq ifr;
|
|||
|
|
- int fd = __opensock ();
|
|||
|
|
-
|
|||
|
|
- if (fd < 0)
|
|||
|
|
- return 0;
|
|||
|
|
-
|
|||
|
|
if (strlen (ifname) >= IFNAMSIZ)
|
|||
|
|
{
|
|||
|
|
__set_errno (ENODEV);
|
|||
|
|
@@ -50,6 +45,12 @@ __if_nametoindex (const char *ifname)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
strncpy (ifr.ifr_name, ifname, sizeof (ifr.ifr_name));
|
|||
|
|
+
|
|||
|
|
+ int fd = __opensock ();
|
|||
|
|
+
|
|||
|
|
+ if (fd < 0)
|
|||
|
|
+ return 0;
|
|||
|
|
+
|
|||
|
|
if (__ioctl (fd, SIOCGIFINDEX, &ifr) < 0)
|
|||
|
|
{
|
|||
|
|
int saved_errno = errno;
|
|||
|
|
|