From owner-freebsd-bugs@FreeBSD.ORG Sat Apr 25 23:20:01 2009 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E577B1065674 for ; Sat, 25 Apr 2009 23:20:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id C0BDE8FC20 for ; Sat, 25 Apr 2009 23:20:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n3PNK1nl027512 for ; Sat, 25 Apr 2009 23:20:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n3PNK12p027511; Sat, 25 Apr 2009 23:20:01 GMT (envelope-from gnats) Resent-Date: Sat, 25 Apr 2009 23:20:01 GMT Resent-Message-Id: <200904252320.n3PNK12p027511@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Mateusz Guzik Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 4D5831065672 for ; Sat, 25 Apr 2009 23:17:13 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 209528FC1A for ; Sat, 25 Apr 2009 23:17:13 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n3PNHCYa049970 for ; Sat, 25 Apr 2009 23:17:12 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id n3PNHC9U049969; Sat, 25 Apr 2009 23:17:12 GMT (envelope-from nobody) Message-Id: <200904252317.n3PNHC9U049969@www.freebsd.org> Date: Sat, 25 Apr 2009 23:17:12 GMT From: Mateusz Guzik To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/134010: [gssapi][patch] Buffer overflow and use-after-free in gssd_syscall X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Apr 2009 23:20:02 -0000 >Number: 134010 >Category: kern >Synopsis: [gssapi][patch] Buffer overflow and use-after-free in gssd_syscall >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sat Apr 25 23:20:01 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Mateusz Guzik >Release: 8.0-CURRENT >Organization: >Environment: FreeBSD eternal 8.0-CURRENT FreeBSD 8.0-CURRENT #1: Sat Apr 25 17:21:50 CEST 2009 f@eternal:/usr/obj/srv/build/CURRENT/src/sys/ETERNAL i386 >Description: 1) Buffer overflow gssd_syscall contains the following code: char path[MAXPATHLEN]; [..] error = copyinstr(uap->path, path, sizeof(path), NULL); [..] strcpy(sun.sun_path, path); sun_path's size is 104 while MAXPATHLEN expands to 1024, thus providing string large enough will cause buffer overflow. 2) Use after free error = priv_check(td, PRIV_NFS_DAEMON); if (error) return (error); if (kgss_gssd_handle) CLNT_DESTROY(kgss_gssd_handle); error = copyinstr(uap->path, path, sizeof(path), NULL); if (error) return (error); [..] kgss_gssd_handle = clnt_reconnect_create(nconf,[..] So one "correct" call of gssd_syscall will set kgss_gssd_handle, the first call with incorrect path will invalidate it and the second call will cause panic. >How-To-Repeat: Using the following code: int main(int argc, char **argv) { gssd_syscall(argv[1]); return (0); } 1) Buffer overflow ./a.out `perl -e 'print("A"x1000)'` 2) Use after free ./a.out `perl -e 'print("A"x100)'`; ./a.out `perl -e 'print("A"x2000)'`; ./a.out `perl -e 'print("A"x2000)'` >Fix: Replace MAXPATHLEN with sizeof(sun.sun_path) and move CLNT_DESTROY(kgss_gssd_handle) after copyinstr. Patch attached with submission follows: --- gss_impl.c.orig 2008-11-03 11:38:00.000000000 +0100 +++ gss_impl.c 2009-04-26 00:42:01.000000000 +0200 @@ -89,20 +89,20 @@ { struct sockaddr_un sun; struct netconfig *nconf; - char path[MAXPATHLEN]; + char path[sizeof(sun.sun_path)]; int error; error = priv_check(td, PRIV_NFS_DAEMON); if (error) return (error); - if (kgss_gssd_handle) - CLNT_DESTROY(kgss_gssd_handle); - error = copyinstr(uap->path, path, sizeof(path), NULL); if (error) return (error); + if (kgss_gssd_handle) + CLNT_DESTROY(kgss_gssd_handle); + sun.sun_family = AF_LOCAL; strcpy(sun.sun_path, path); sun.sun_len = SUN_LEN(&sun); >Release-Note: >Audit-Trail: >Unformatted: