AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-12-12 06:10:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

CVE-2018-19591: if_nametoindex: Fix descriptor for overlong name [BZ #23927]

Browse Source 
(cherry picked from commit d527c860f5)
This commit is contained in:
Florian Weimer 2018-11-27 16:12:43 +01:00
parent 27e46f5836
commit a0bc5dd3be
3 changed files with 18 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,3 +1,10 @@
2018-11-27 Florian Weimer <fweimer@redhat.com>
[BZ #23927]
CVE-2018-19591
* sysdeps/unix/sysv/linux/if_index.c (__if_nametoindex): Avoid
descriptor leak in case of ENODEV error.
2018-11-08 Alexandra Hájková <ahajkova@redhat.com>
[BZ #17630]

5
NEWS
View File

@ -82,6 +82,10 @@ Security related changes:
architecture could write beyond the target buffer, resulting in a buffer
overflow. Reported by Andreas Schwab.
CVE-2018-19591: A file descriptor leak in if_nametoindex can lead to a
denial of service due to resource exhaustion when processing getaddrinfo
calls with crafted host names. Reported by Guido Vranken.
The following bugs are resolved with this release:
[16750] ldd: Never run file directly.
@ -158,6 +162,7 @@ The following bugs are resolved with this release:
[23562] signal: Use correct type for si_band in siginfo_t
[23579] libc: Errors misreported in preadv2
[23709] Fix CPU string flags for Haswell-type CPUs
[23927] Linux if_nametoindex() does not close descriptor (CVE-2018-19591)
Version 2.26

11
sysdeps/unix/sysv/linux/if_index.c
View File

@ -38,11 +38,6 @@ __if_nametoindex (const char *ifname)
return 0;
#else
struct ifreq ifr;
int fd = __opensock ();
if (fd < 0)
return 0;
if (strlen (ifname) >= IFNAMSIZ)
{
__set_errno (ENODEV);
@ -50,6 +45,12 @@ __if_nametoindex (const char *ifname)
}
strncpy (ifr.ifr_name, ifname, sizeof (ifr.ifr_name));
int fd = __opensock ();
if (fd < 0)
return 0;
if (__ioctl (fd, SIOCGIFINDEX, &ifr) < 0)
{
int saved_errno = errno;