Date: Mon, 16 Mar 2009 18:55:08 GMT From: Chris St Denis <chris@smartt.com> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/132705: libwrap - infinite loop if hosts.allow line > 2k Message-ID: <200903161855.n2GIt8Ke077186@www.freebsd.org> Resent-Message-ID: <200903161900.n2GJ06KV054408@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 132705
>Category: misc
>Synopsis: libwrap - infinite loop if hosts.allow line > 2k
>Confidential: no
>Severity: serious
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Mar 16 19:00:05 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator: Chris St Denis
>Release: 7.0, 7.1
>Organization:
SmarttNet
>Environment:
FreeBSD carbon.smartt.com 7.0-RELEASE-p9 FreeBSD 7.0-RELEASE-p9 #4: Sun Jan 18 00:08:59 PST 2009 cstdenis@carbon.smartt.com:/usr/obj/usr/src/sys/CARBON i386
FreeBSD crash.smartt.com 7.1-RELEASE FreeBSD 7.1-RELEASE #0: Wed Mar 11 13:10:27 PDT 2009 cstdenis@crash.smartt.com:/usr/obj/usr/src/sys/GENERIC i386
>Description:
When given an input line of more than 2k bytes, libwrap ends up in an
infinite loop in xgets(), calling fgets() with a read length of one.
As fgets() reads the length minus one characters, it will keep
"reading" and returning zero length strings.
This causes network daemons that use libwrap stop accepting
incoming network connections and use 100% cpu on an incoming connection.
This problem appeared because sshguard placed a large number of IPs (around 1000) in my hosts.allow file triggering this bug.
Backtrace of an affected sshd process:
crash# gdb /usr/sbin/sshd 691
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and
you are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for
details.
This GDB was configured as "i386-marcel-freebsd"...
Attaching to program: /usr/sbin/sshd, process 691
Reading symbols from /usr/lib/libssh.so.4...done.
Loaded symbols for /usr/lib/libssh.so.4
Reading symbols from /lib/libutil.so.7...done.
Loaded symbols for /lib/libutil.so.7
Reading symbols from /lib/libz.so.4...done.
Loaded symbols for /lib/libz.so.4
Reading symbols from /usr/lib/libwrap.so.5...done.
Loaded symbols for /usr/lib/libwrap.so.5
<snip other symbols for breviry>
Reading symbols from /libexec/ld-elf.so.1...done.
Loaded symbols for /libexec/ld-elf.so.1
0x28373225 in fgets (buf=0xbfbfe67b "", n=1, fp=0x283b8040) at
/usr/src/lib/libc/stdio/fgets.c:56
56 {
(gdb) bt
#0 0x28373225 in fgets (buf=0xbfbfe67b "", n=1, fp=0x283b8040) at
/usr/src/lib/libc/stdio/fgets.c:56
#1 0x281124ee in xgets (ptr=0xbfbfe67b "", len=1, fp=0x283b8040) at
/usr/src/lib/libwrap/../../contrib/tcp_wrappers/misc.c:38
#2 0x28111410 in table_match (table=0x28112c5c "/etc/hosts.allow",
request=0xbfbfeb14)
at
/usr/src/lib/libwrap/../../contrib/tcp_wrappers/hosts_access.c:162
#3 0x28111540 in hosts_access (request=0xbfbfeb14) at
/usr/src/lib/libwrap/../../contrib/tcp_wrappers/hosts_access.c:132
#4 0x08052b39 in main (ac=2, av=0xbfbfeecc) at
/usr/src/secure/usr.sbin/sshd/../../../crypto/openssh/sshd.c:1843
(gdb) bt
#0 0x28373225 in fgets (buf=0xbfbfe67b "", n=1, fp=0x283b8040) at
/usr/src/lib/libc/stdio/fgets.c:56
#1 0x281124ee in xgets (ptr=0xbfbfe67b "", len=1, fp=0x283b8040) at
/usr/src/lib/libwrap/../../contrib/tcp_wrappers/misc.c:38
#2 0x28111410 in table_match (table=0x28112c5c "/etc/hosts.allow",
request=0xbfbfeb14)
at
/usr/src/lib/libwrap/../../contrib/tcp_wrappers/hosts_access.c:162
#3 0x28111540 in hosts_access (request=0xbfbfeb14) at
/usr/src/lib/libwrap/../../contrib/tcp_wrappers/hosts_access.c:132
#4 0x08052b39 in main (ac=2, av=0xbfbfeecc) at
/usr/src/secure/usr.sbin/sshd/../../../crypto/openssh/sshd.c:1843
(gdb) q
The program is running. Quit anyway (and detach it)? (y or n) y
Detaching from program: /usr/sbin/sshd, process 691
See also: thread on FreeBSD Hackers list: http://docs.freebsd.org/cgi/getmsg.cgi?fetch=203036+0+archive/2009/freebsd-hackers/20090315.freebsd-hackers
>How-To-Repeat:
Create a hosts.allow file with a long line, such as:
Example hosts.allow file (IPs are randomly generated for purposes of example)
sshd : 112.110.123.63 113.11.2.126 113.11.8.6 113.19.19.22
113.197.48.68 <snipped 990+ IPs for space> 116.48.108.244 116.48.11.19 : deny
ALL : ALL : allow
connect to any network daemon using libwrap (such as sshd).
>Fix:
Mikko Työläjärvi from the FreeBSD Hackers list provided a possible patch and some recommendations for better patching. His contribution pasted below.
This Q&D patch makes libwrap behave as documented in hosts_access(5):
--- misc.c.orig 2009-03-15 14:06:11.000000000 -0700
+++ misc.c 2009-03-15 14:06:49.000000000 -0700
@@ -48,6 +48,8 @@
ptr += got;
len -= got;
ptr[0] = 0;
+ if (len <= 1)
+ return start;
}
return (ptr > start ? start : 0);
}
..
This is only sligtly better, as the code will now try to parse the
remainder of the line as a rule, and either fail or, due to some
syntactic quirk, get a false match. From a security standpoint, both
are bad.
..
The real fix involves rewriting chunks of the libwrap code, or finding
a version where someone has already done so.
See also, his full post: http://docs.freebsd.org/cgi/getmsg.cgi?fetch=3542+0+current/freebsd-hackers
Nate Eldredge also commented:
It doesn't seem like it should be too bad. xgets is only called in three places. It would be easy enough to replace it with something like glibc's getline(3), that uses realloc to size a buffer appropriately.
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200903161855.n2GIt8Ke077186>