diff options
author | Siddhesh Poyarekar <siddhesh@sourceware.org> | 2023-09-15 13:51:12 -0400 |
---|---|---|
committer | Siddhesh Poyarekar <siddhesh@sourceware.org> | 2023-09-15 15:20:22 -0400 |
commit | 6529a7466c935f36e9006b854d6f4e1d4876f942 (patch) | |
tree | eabe51a8df8c83b4b32f97100b74f49016be18d5 /nss/tst-nss-gai-hv2-canonname.h | |
parent | b7529346025a130fee483d42178b5c118da971bb (diff) | |
download | glibc-6529a7466c935f36e9006b854d6f4e1d4876f942.tar.gz glibc-6529a7466c935f36e9006b854d6f4e1d4876f942.tar.xz glibc-6529a7466c935f36e9006b854d6f4e1d4876f942.zip |
getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806)
When an NSS plugin only implements the _gethostbyname2_r and _getcanonname_r callbacks, getaddrinfo could use memory that was freed during tmpbuf resizing, through h_name in a previous query response. The backing store for res->at->name when doing a query with gethostbyname3_r or gethostbyname2_r is tmpbuf, which is reallocated in gethosts during the query. For AF_INET6 lookup with AI_ALL | AI_V4MAPPED, gethosts gets called twice, once for a v6 lookup and second for a v4 lookup. In this case, if the first call reallocates tmpbuf enough number of times, resulting in a malloc, th->h_name (that res->at->name refers to) ends up on a heap allocated storage in tmpbuf. Now if the second call to gethosts also causes the plugin callback to return NSS_STATUS_TRYAGAIN, tmpbuf will get freed, resulting in a UAF reference in res->at->name. This then gets dereferenced in the getcanonname_r plugin call, resulting in the use after free. Fix this by copying h_name over and freeing it at the end. This resolves BZ #30843, which is assigned CVE-2023-4806. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit 973fe93a5675c42798b2161c6f29c01b0e243994)
Diffstat (limited to 'nss/tst-nss-gai-hv2-canonname.h')
-rw-r--r-- | nss/tst-nss-gai-hv2-canonname.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/nss/tst-nss-gai-hv2-canonname.h b/nss/tst-nss-gai-hv2-canonname.h new file mode 100644 index 0000000000..14f2a9cb08 --- /dev/null +++ b/nss/tst-nss-gai-hv2-canonname.h @@ -0,0 +1 @@ +#define QUERYNAME "test.example.com" |