CVE-2021-4091 - double-free of the virtual attribute context in persistent search...
authortbordaz <tbordaz@redhat.com>
Mon, 21 Mar 2022 13:24:12 +0000 (14:24 +0100)
committerAndrej Shadura <andrewsh@debian.org>
Sun, 19 Jan 2025 12:30:31 +0000 (13:30 +0100)
commit731b7b99613b0ed501b88e093b6cfb683a85cc71
tree9ecb66f8658d7461d3fd1f28a52baa6deaae6bc6
parent4b2afbd7921cb779a5a814deaf9a43bee23463f2
CVE-2021-4091 - double-free of the virtual attribute context in persistent search (#5219) - Issue 5218

description:
A search is processed by a worker using a private pblock.
If the search is persistent, the worker spawn a thread
and kind of duplicate its private pblock so that the spawn
        thread continue to process the persistent search.
Then worker ends the initial search, reinit (free) its private pblock,
        and returns monitoring the wait_queue.
When the persistent search completes, it frees the duplicated
pblock.
The problem is that private pblock and duplicated pblock
        are referring to a same structure (pb_vattr_context).
        That can lead to a double free

Fix:
When cloning the pblock (slapi_pblock_clone) make sure
to transfert the references inside the original (private)
pblock to the target (cloned) one
        That includes pb_vattr_context pointer.

Reviewed by: Mark Reynolds, James Chapman, Pierre Rogier (Thanks !)

Co-authored-by: Mark Reynolds <mreynolds@redhat.com>
Origin: upstream, commit:a3c298f8140d3e4fa1bd5a670f1bb965a21a9b7b

Gbp-Pq: Name CVE-2021-4091-double-free-of-virtual-attribute-ctx.patch
ldap/servers/slapd/connection.c
ldap/servers/slapd/pblock.c