From: Florian Weimer <fweimer@redhat.com>
Date: Mon, 17 Jan 2022 09:21:34 +0000 (+0100)
Subject: [PATCH] CVE-2022-23218: Buffer overflow in sunrpc svcunix_create (bug 28768)
X-Git-Tag: archive/raspbian/2.28-10+rpi1+deb10u3^2~4
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=e24d4b8c9e2bb0e920708ec6b2b340dbd635efda;p=glibc.git

[PATCH] CVE-2022-23218: Buffer overflow in sunrpc svcunix_create (bug 28768)

The sunrpc function svcunix_create suffers from a stack-based buffer
overflow with overlong pathname arguments.

Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>

Helmut Grohne: Ported to glibc 2.28. Inlined __sockaddr_un_set.


Gbp-Pq: Topic all
Gbp-Pq: Name git-CVE-2022-23218-Buffer-overflow-in-sunrpc-svcunix_cre.diff
---

diff --git a/sunrpc/Makefile b/sunrpc/Makefile
index 85b0b3356..7f910ed5b 100644
--- a/sunrpc/Makefile
+++ b/sunrpc/Makefile
@@ -95,7 +95,7 @@ others += rpcgen
 endif
 
 tests = tst-xdrmem tst-xdrmem2 test-rpcent tst-udp-error tst-udp-timeout \
-  tst-udp-nonblocking
+  tst-udp-nonblocking tst-bug28768
 xtests := tst-getmyaddr
 
 ifeq ($(have-thread-library),yes)
diff --git a/sunrpc/svc_unix.c b/sunrpc/svc_unix.c
index c2c076aa8..8f4dcaf50 100644
--- a/sunrpc/svc_unix.c
+++ b/sunrpc/svc_unix.c
@@ -154,7 +154,14 @@ svcunix_create (int sock, u_int sendsize, u_int recvsize, char *path)
   SVCXPRT *xprt;
   struct unix_rendezvous *r;
   struct sockaddr_un addr;
-  socklen_t len = sizeof (struct sockaddr_in);
+  socklen_t len = sizeof (addr);
+  size_t path_length = strlen(path);
+
+  if (path_length >= sizeof(addr.sun_path))
+    {
+      __set_errno (EINVAL);     /* Error code used by the kernel.  */
+      return NULL;
+    }
 
   if (sock == RPC_ANYSOCK)
     {
@@ -165,11 +172,8 @@ svcunix_create (int sock, u_int sendsize, u_int recvsize, char *path)
 	}
       madesock = TRUE;
     }
-  memset (&addr, '\0', sizeof (addr));
   addr.sun_family = AF_UNIX;
-  len = strlen (path) + 1;
-  memcpy (addr.sun_path, path, len);
-  len += sizeof (addr.sun_family);
+  memcpy(addr.sun_path, path, path_length + 1);
 
   __bind (sock, (struct sockaddr *) &addr, len);
 
diff --git a/sunrpc/tst-bug28768.c b/sunrpc/tst-bug28768.c
new file mode 100644
index 000000000..66b1b79c4
--- /dev/null
+++ b/sunrpc/tst-bug28768.c
@@ -0,0 +1,39 @@
+/* Test to verify that long path is rejected by svcunix_create (bug 28768).
+   Copyright (C) 2022 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <errno.h>
+#include <rpc/svc.h>
+#include <shlib-compat.h>
+#include <string.h>
+#include <support/check.h>
+
+static int
+do_test (void)
+{
+  char pathname[109];
+  memset (pathname, 'x', sizeof (pathname));
+  pathname[sizeof (pathname) - 1] = '\0';
+
+  errno = 0;
+  TEST_VERIFY (svcunix_create (RPC_ANYSOCK, 4096, 4096, pathname) == NULL);
+  TEST_COMPARE (errno, EINVAL);
+
+  return 0;
+}
+
+#include <support/test-driver.c>