[PATCH] CVE-2022-23218: Buffer overflow in sunrpc svcunix_create (bug 28768)

The sunrpc function svcunix_create suffers from a stack-based buffer
overflow with overlong pathname arguments.

Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Helmut Grohne: Ported to glibc 2.28. Inlined __sockaddr_un_set.

Gbp-Pq: Topic all
Gbp-Pq: Name git-CVE-2022-23218-Buffer-overflow-in-sunrpc-svcunix_cre.diff

diff --git a/sunrpc/Makefile b/sunrpc/Makefile
index 85b0b3356aaf81a3c914d4307379e3e61e2b3f96..7f910ed5b3f38d66a7b5a38a14abbf6cfa831be3 100644 (file)
--- a/sunrpc/Makefile
+++ b/sunrpc/Makefile
@@ -95,7 +95,7 @@ others += rpcgen
 endif
 
 tests = tst-xdrmem tst-xdrmem2 test-rpcent tst-udp-error tst-udp-timeout \
-  tst-udp-nonblocking
+  tst-udp-nonblocking tst-bug28768
 xtests := tst-getmyaddr
 
 ifeq ($(have-thread-library),yes)

diff --git a/sunrpc/svc_unix.c b/sunrpc/svc_unix.c
index c2c076aa87f0a2ad7d0381146dc0db097cb14a0b..8f4dcaf50320ffc9aa95c343db87229b73aa67ab 100644 (file)
--- a/sunrpc/svc_unix.c
+++ b/sunrpc/svc_unix.c
@@ -154,7 +154,14 @@ svcunix_create (int sock, u_int sendsize, u_int recvsize, char *path)
   SVCXPRT *xprt;
   struct unix_rendezvous *r;
   struct sockaddr_un addr;
-  socklen_t len = sizeof (struct sockaddr_in);
+  socklen_t len = sizeof (addr);
+  size_t path_length = strlen(path);
+
+  if (path_length >= sizeof(addr.sun_path))
+    {
+      __set_errno (EINVAL);     /* Error code used by the kernel.  */
+      return NULL;
+    }
 
   if (sock == RPC_ANYSOCK)
     {
@@ -165,11 +172,8 @@ svcunix_create (int sock, u_int sendsize, u_int recvsize, char *path)
        }
       madesock = TRUE;
     }
-  memset (&addr, '\0', sizeof (addr));
   addr.sun_family = AF_UNIX;
-  len = strlen (path) + 1;
-  memcpy (addr.sun_path, path, len);
-  len += sizeof (addr.sun_family);
+  memcpy(addr.sun_path, path, path_length + 1);
 
   __bind (sock, (struct sockaddr *) &addr, len);
 

diff --git a/sunrpc/tst-bug28768.c b/sunrpc/tst-bug28768.c
new file mode 100644 (file)
index 0000000..66b1b79
--- /dev/null
+++ b/sunrpc/tst-bug28768.c
@@ -0,0 +1,39 @@
+/* Test to verify that long path is rejected by svcunix_create (bug 28768).
+   Copyright (C) 2022 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <errno.h>
+#include <rpc/svc.h>
+#include <shlib-compat.h>
+#include <string.h>
+#include <support/check.h>
+
+static int
+do_test (void)
+{
+  char pathname[109];
+  memset (pathname, 'x', sizeof (pathname));
+  pathname[sizeof (pathname) - 1] = '\0';
+
+  errno = 0;
+  TEST_VERIFY (svcunix_create (RPC_ANYSOCK, 4096, 4096, pathname) == NULL);
+  TEST_COMPARE (errno, EINVAL);
+
+  return 0;
+}
+
+#include <support/test-driver.c>