Bug 16072 (CVE-2013-4458) - Segmentation fault in getaddrinfo() when processing entry mapping to long list of AF_INET6 address structures
Summary: Segmentation fault in getaddrinfo() when processing entry mapping to long lis...
Status: RESOLVED FIXED
Alias: CVE-2013-4458
Product: glibc
Classification: Unclassified
Component: network (show other bugs)
Version: 2.18
: P2 normal
Target Milestone: ---
Assignee: Siddhesh Poyarekar
URL:
Keywords:
Depends on: 16071
Blocks:
  Show dependency tree / graph
 
Reported: 2013-10-22 06:45 UTC by Siddhesh Poyarekar
Modified: 2016-04-27 09:29 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Siddhesh Poyarekar 2013-10-22 06:45:55 UTC 
+++ This bug was initially created as a clone of Bug #16071 +++

Adding a large number of IPv6 entries for a host in /etc/hosts and then querying it results in a segmentation fault.

How reproducible:

Always

Steps to Reproduce:
  1. Create 50K '127.0.0.1 host-fubar' entries, and 50K '::1 host-fubar' entries in '/etc/hosts'.
  2. Call getaddrinfo for 'node' = "host-fubar", no 'flags' set, and AF_INET in 'hints->ai_family'.

Actual results:

    SIGSEGV

Expected results:

    No SIGSEGV

Patch coming up.
Comment 1 Siddhesh Poyarekar 2013-10-23 04:17:15 UTC 
This has been assigned CVE-2013-4458.
Comment 2 Siddhesh Poyarekar 2013-10-25 05:00:24 UTC 
Fixed in master:

commit 7cbcdb3699584db8913ca90f705d6337633ee10f
Author: Siddhesh Poyarekar <siddhesh@redhat.com>
Date:   Fri Oct 25 10:22:12 2013 +0530

    Fix stack overflow due to large AF_INET6 requests
    
    Resolves #16072 (CVE-2013-4458).
    
    This patch fixes another stack overflow in getaddrinfo when it is
    called with AF_INET6.  The AF_UNSPEC case was fixed as CVE-2013-1914,
    but the AF_INET6 case went undetected back then.

 ChangeLog                   |  6 ++++++
 NEWS                        |  5 ++++-
 sysdeps/posix/getaddrinfo.c | 20 ++++++++++++++++++--
 3 files changed, 28 insertions(+), 3 deletions(-)