From: GNU Libc Maintainers <debian-glibc@lists.debian.org>
Date: Tue, 30 Apr 2024 21:57:11 +0000 (+0200)
Subject: local-CVE-2024-33599-nscd
X-Git-Tag: archive/raspbian/2.31-13+rpi1+deb11u10^2~3
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=aa36ac82dbc1d6a0eff03d709cce8036914f9850;p=glibc.git

local-CVE-2024-33599-nscd

commit 69c58d5ef9f584ea198bd00f7964d364d0e6b921
Author: Florian Weimer <fweimer@redhat.com>
Date:   Thu Apr 25 15:00:45 2024 +0200

    CVE-2024-33599: nscd: Stack-based buffer overflow in netgroup cache (bug 31677)

    Using alloca matches what other caches do.  The request length is
    bounded by MAXKEYLEN.

    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit 87801a8fd06db1d654eea3e4f7626ff476a9bdaa)


Gbp-Pq: Topic any
Gbp-Pq: Name local-CVE-2024-33599-nscd.patch
---

diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c
index 381aa721e..a833ef039 100644
--- a/nscd/netgroupcache.c
+++ b/nscd/netgroupcache.c
@@ -503,12 +503,13 @@ addinnetgrX (struct database_dyn *db, int fd, request_header *req,
       = (struct indataset *) mempool_alloc (db,
 					    sizeof (*dataset) + req->key_len,
 					    1);
-  struct indataset dataset_mem;
   bool cacheable = true;
   if (__glibc_unlikely (dataset == NULL))
     {
       cacheable = false;
-      dataset = &dataset_mem;
+      /* The alloca is safe because nscd_run_worker verfies that
+	 key_len is not larger than MAXKEYLEN.  */
+      dataset = alloca (sizeof (*dataset) + req->key_len);
     }
 
   datahead_init_pos (&dataset->head, sizeof (*dataset) + req->key_len,