From owner-freebsd-bugs@FreeBSD.ORG Mon Mar 16 19:00:06 2009 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6E52610656C2 for ; Mon, 16 Mar 2009 19:00:06 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 28B3F8FC08 for ; Mon, 16 Mar 2009 19:00:06 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n2GJ06Ng054412 for ; Mon, 16 Mar 2009 19:00:06 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n2GJ06KV054408; Mon, 16 Mar 2009 19:00:06 GMT (envelope-from gnats) Resent-Date: Mon, 16 Mar 2009 19:00:06 GMT Resent-Message-Id: <200903161900.n2GJ06KV054408@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Chris St Denis Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 5D17F106564A for ; Mon, 16 Mar 2009 18:55:08 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 4AB6D8FC1A for ; Mon, 16 Mar 2009 18:55:08 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n2GIt8Ll077187 for ; Mon, 16 Mar 2009 18:55:08 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id n2GIt8Ke077186; Mon, 16 Mar 2009 18:55:08 GMT (envelope-from nobody) Message-Id: <200903161855.n2GIt8Ke077186@www.freebsd.org> Date: Mon, 16 Mar 2009 18:55:08 GMT From: Chris St Denis To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: misc/132705: libwrap - infinite loop if hosts.allow line > 2k X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Mar 2009 19:00:07 -0000 >Number: 132705 >Category: misc >Synopsis: libwrap - infinite loop if hosts.allow line > 2k >Confidential: no >Severity: serious >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Mar 16 19:00:05 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Chris St Denis >Release: 7.0, 7.1 >Organization: SmarttNet >Environment: FreeBSD carbon.smartt.com 7.0-RELEASE-p9 FreeBSD 7.0-RELEASE-p9 #4: Sun Jan 18 00:08:59 PST 2009 cstdenis@carbon.smartt.com:/usr/obj/usr/src/sys/CARBON i386 FreeBSD crash.smartt.com 7.1-RELEASE FreeBSD 7.1-RELEASE #0: Wed Mar 11 13:10:27 PDT 2009 cstdenis@crash.smartt.com:/usr/obj/usr/src/sys/GENERIC i386 >Description: When given an input line of more than 2k bytes, libwrap ends up in an infinite loop in xgets(), calling fgets() with a read length of one. As fgets() reads the length minus one characters, it will keep "reading" and returning zero length strings. This causes network daemons that use libwrap stop accepting incoming network connections and use 100% cpu on an incoming connection. This problem appeared because sshguard placed a large number of IPs (around 1000) in my hosts.allow file triggering this bug. Backtrace of an affected sshd process: crash# gdb /usr/sbin/sshd 691 GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd"... Attaching to program: /usr/sbin/sshd, process 691 Reading symbols from /usr/lib/libssh.so.4...done. Loaded symbols for /usr/lib/libssh.so.4 Reading symbols from /lib/libutil.so.7...done. Loaded symbols for /lib/libutil.so.7 Reading symbols from /lib/libz.so.4...done. Loaded symbols for /lib/libz.so.4 Reading symbols from /usr/lib/libwrap.so.5...done. Loaded symbols for /usr/lib/libwrap.so.5 Reading symbols from /libexec/ld-elf.so.1...done. Loaded symbols for /libexec/ld-elf.so.1 0x28373225 in fgets (buf=0xbfbfe67b "", n=1, fp=0x283b8040) at /usr/src/lib/libc/stdio/fgets.c:56 56 { (gdb) bt #0 0x28373225 in fgets (buf=0xbfbfe67b "", n=1, fp=0x283b8040) at /usr/src/lib/libc/stdio/fgets.c:56 #1 0x281124ee in xgets (ptr=0xbfbfe67b "", len=1, fp=0x283b8040) at /usr/src/lib/libwrap/../../contrib/tcp_wrappers/misc.c:38 #2 0x28111410 in table_match (table=0x28112c5c "/etc/hosts.allow", request=0xbfbfeb14) at /usr/src/lib/libwrap/../../contrib/tcp_wrappers/hosts_access.c:162 #3 0x28111540 in hosts_access (request=0xbfbfeb14) at /usr/src/lib/libwrap/../../contrib/tcp_wrappers/hosts_access.c:132 #4 0x08052b39 in main (ac=2, av=0xbfbfeecc) at /usr/src/secure/usr.sbin/sshd/../../../crypto/openssh/sshd.c:1843 (gdb) bt #0 0x28373225 in fgets (buf=0xbfbfe67b "", n=1, fp=0x283b8040) at /usr/src/lib/libc/stdio/fgets.c:56 #1 0x281124ee in xgets (ptr=0xbfbfe67b "", len=1, fp=0x283b8040) at /usr/src/lib/libwrap/../../contrib/tcp_wrappers/misc.c:38 #2 0x28111410 in table_match (table=0x28112c5c "/etc/hosts.allow", request=0xbfbfeb14) at /usr/src/lib/libwrap/../../contrib/tcp_wrappers/hosts_access.c:162 #3 0x28111540 in hosts_access (request=0xbfbfeb14) at /usr/src/lib/libwrap/../../contrib/tcp_wrappers/hosts_access.c:132 #4 0x08052b39 in main (ac=2, av=0xbfbfeecc) at /usr/src/secure/usr.sbin/sshd/../../../crypto/openssh/sshd.c:1843 (gdb) q The program is running. Quit anyway (and detach it)? (y or n) y Detaching from program: /usr/sbin/sshd, process 691 See also: thread on FreeBSD Hackers list: http://docs.freebsd.org/cgi/getmsg.cgi?fetch=203036+0+archive/2009/freebsd-hackers/20090315.freebsd-hackers >How-To-Repeat: Create a hosts.allow file with a long line, such as: Example hosts.allow file (IPs are randomly generated for purposes of example) sshd : 112.110.123.63 113.11.2.126 113.11.8.6 113.19.19.22 113.197.48.68 116.48.108.244 116.48.11.19 : deny ALL : ALL : allow connect to any network daemon using libwrap (such as sshd). >Fix: Mikko Työläjärvi from the FreeBSD Hackers list provided a possible patch and some recommendations for better patching. His contribution pasted below. This Q&D patch makes libwrap behave as documented in hosts_access(5): --- misc.c.orig 2009-03-15 14:06:11.000000000 -0700 +++ misc.c 2009-03-15 14:06:49.000000000 -0700 @@ -48,6 +48,8 @@ ptr += got; len -= got; ptr[0] = 0; + if (len <= 1) + return start; } return (ptr > start ? start : 0); } .. This is only sligtly better, as the code will now try to parse the remainder of the line as a rule, and either fail or, due to some syntactic quirk, get a false match. From a security standpoint, both are bad. .. The real fix involves rewriting chunks of the libwrap code, or finding a version where someone has already done so. See also, his full post: http://docs.freebsd.org/cgi/getmsg.cgi?fetch=3542+0+current/freebsd-hackers Nate Eldredge also commented: It doesn't seem like it should be too bad. xgets is only called in three places. It would be easy enough to replace it with something like glibc's getline(3), that uses realloc to size a buffer appropriately. >Release-Note: >Audit-Trail: >Unformatted: