Bug 28931 (CVE-2023-4813) - hosts lookup broken for SUCCESS=CONTINUE and SUCCESS=MERGE (CVE-2023-4813)
Summary: hosts lookup broken for SUCCESS=CONTINUE and SUCCESS=MERGE (CVE-2023-4813)
Status: RESOLVED FIXED
Alias: CVE-2023-4813
Product: glibc
Classification: Unclassified
Component: libc (show other bugs)
Version: 2.35
: P2 normal
Target Milestone: 2.36
Assignee: Siddhesh Poyarekar
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-03-01 02:33 UTC by Siddhesh Poyarekar
Modified: 2023-09-15 15:32 UTC (History)
3 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
Project(s) to access:
ssh public key:
siddhesh: security+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Siddhesh Poyarekar 2022-03-01 02:33:50 UTC
SUCCESS=CONTINUE should discard any results so far and try the next NSS module.  The current implementation in gaih_inet however does not do that.  SUCCESS=MERGE should merge results from the previous and next module but that is broken with gethostbyname4_r, since it tries to allocate both into the same scratch buffer, overwriting the previous results.
Comment 1 Siddhesh Poyarekar 2022-03-01 02:34:39 UTC
Bugs triggered by nsswitch.conf, which already needs root to change.
Comment 2 Siddhesh Poyarekar 2022-03-02 08:58:15 UTC
(In reply to Siddhesh Poyarekar from comment #0)
> SUCCESS=MERGE should merge results from the previous and next module but
> that is broken with gethostbyname4_r, since it tries to allocate both into
> the same scratch buffer, overwriting the previous results.

Re-reading the manual, it looks like we require SUCCESS=merge to return lookup failure for all but the groups database.

====
The @samp{merge} only applies to the @samp{success} status.  It is 
currently implemented for the @samp{group} database and its group  
members field, @samp{gr_mem}.  If specified for other databases, it
causes the lookup to fail (if the @var{status} matches).           
====
Comment 3 Sourceware Commits 2022-03-22 14:13:04 UTC
The master branch has been updated by Siddhesh Poyarekar <siddhesh@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=1c37b8022e8763fedbb3f79c02e05c6acfe5a215

commit 1c37b8022e8763fedbb3f79c02e05c6acfe5a215
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Thu Mar 17 11:44:34 2022 +0530

    Simplify allocations and fix merge and continue actions [BZ #28931]
    
    Allocations for address tuples is currently a bit confusing because of
    the pointer chasing through PAT, making it hard to observe the sequence
    in which allocations have been made.  Narrow scope of the pointer
    chasing through PAT so that it is only used where necessary.
    
    This also tightens actions behaviour with the hosts database in
    getaddrinfo to comply with the manual text.  The "continue" action
    discards previous results and the "merge" action results in an immedate
    lookup failure.  Consequently, chaining of allocations across modules is
    no longer necessary, thus opening up cleanup opportunities.
    
    A test has been added that checks some combinations to ensure that they
    work correctly.
    
    Resolves: BZ #28931
    
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: DJ Delorie <dj@redhat.com>
Comment 4 Siddhesh Poyarekar 2022-03-22 14:15:32 UTC
Fixed.
Comment 5 Siddhesh Poyarekar 2023-09-12 15:29:32 UTC
Apparently this configuration (inexplicably) does seem to be getting some use, so this now has a CVE number. It's probably a good time to note that SUCCESS=continue and SUCCESS=merge are not supported by the hosts database.
Comment 6 Sourceware Commits 2023-09-15 02:40:35 UTC
The release/2.35/master branch has been updated by Siddhesh Poyarekar <siddhesh@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=6e867146ee01de3ed1e94e777372093812a578e9

commit 6e867146ee01de3ed1e94e777372093812a578e9
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Thu Mar 17 11:44:34 2022 +0530

    Simplify allocations and fix merge and continue actions [BZ #28931]
    
    Allocations for address tuples is currently a bit confusing because of
    the pointer chasing through PAT, making it hard to observe the sequence
    in which allocations have been made.  Narrow scope of the pointer
    chasing through PAT so that it is only used where necessary.
    
    This also tightens actions behaviour with the hosts database in
    getaddrinfo to comply with the manual text.  The "continue" action
    discards previous results and the "merge" action results in an immedate
    lookup failure.  Consequently, chaining of allocations across modules is
    no longer necessary, thus opening up cleanup opportunities.
    
    A test has been added that checks some combinations to ensure that they
    work correctly.
    
    Resolves: BZ #28931
    
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit 1c37b8022e8763fedbb3f79c02e05c6acfe5a215)
Comment 7 Sourceware Commits 2023-09-15 15:32:20 UTC
The release/2.34/master branch has been updated by Siddhesh Poyarekar <siddhesh@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=228cdb00a045ae3b68a91b35c7548bab6029446e

commit 228cdb00a045ae3b68a91b35c7548bab6029446e
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Thu Mar 17 11:44:34 2022 +0530

    Simplify allocations and fix merge and continue actions [BZ #28931]
    
    Allocations for address tuples is currently a bit confusing because of
    the pointer chasing through PAT, making it hard to observe the sequence
    in which allocations have been made.  Narrow scope of the pointer
    chasing through PAT so that it is only used where necessary.
    
    This also tightens actions behaviour with the hosts database in
    getaddrinfo to comply with the manual text.  The "continue" action
    discards previous results and the "merge" action results in an immedate
    lookup failure.  Consequently, chaining of allocations across modules is
    no longer necessary, thus opening up cleanup opportunities.
    
    A test has been added that checks some combinations to ensure that they
    work correctly.
    
    Resolves: BZ #28931
    
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit 1c37b8022e8763fedbb3f79c02e05c6acfe5a215)