Brad Bishop | 977dc1a | 2019-02-06 16:01:43 -0500 | [diff] [blame] | 1 | From 8ccebb04e07628f7fe10131d6cd4f19d6a0d8f45 Mon Sep 17 00:00:00 2001 |
| 2 | From: Yu Watanabe <watanabe.yu+github@gmail.com> |
| 3 | Date: Wed, 8 Aug 2018 15:06:36 +0900 |
| 4 | Subject: [PATCH] journal: fix syslog_parse_identifier() |
| 5 | |
| 6 | Fixes #9829. |
| 7 | |
| 8 | An out of bounds read was discovered in systemd-journald in the way it |
| 9 | parses log messages that terminate with a colon ':'. A local attacker |
| 10 | can use this flaw to disclose process memory data. |
| 11 | |
| 12 | Patch backported from systemd master at |
| 13 | a6aadf4ae0bae185dc4c414d492a4a781c80ffe5. |
| 14 | |
| 15 | This matches the change done for systemd-journald, hence forming the first |
| 16 | part of the fix for CVE-2018-16866. |
| 17 | --- |
| 18 | src/journal/journald-syslog.c | 6 +++--- |
| 19 | src/journal/test-journal-syslog.c | 10 ++++++++-- |
| 20 | 2 files changed, 11 insertions(+), 5 deletions(-) |
| 21 | |
| 22 | diff --git a/src/journal/journald-syslog.c b/src/journal/journald-syslog.c |
| 23 | index 9dea116722..97711ac7a3 100644 |
| 24 | --- a/src/journal/journald-syslog.c |
| 25 | +++ b/src/journal/journald-syslog.c |
| 26 | @@ -194,7 +194,7 @@ size_t syslog_parse_identifier(const char **buf, char **identifier, char **pid) |
| 27 | e = l; |
| 28 | l--; |
| 29 | |
| 30 | - if (p[l-1] == ']') { |
| 31 | + if (l > 0 && p[l-1] == ']') { |
| 32 | size_t k = l-1; |
| 33 | |
| 34 | for (;;) { |
| 35 | @@ -219,8 +219,8 @@ size_t syslog_parse_identifier(const char **buf, char **identifier, char **pid) |
| 36 | if (t) |
| 37 | *identifier = t; |
| 38 | |
| 39 | - if (strchr(WHITESPACE, p[e])) |
| 40 | - e++; |
| 41 | + e += strspn(p + e, WHITESPACE); |
| 42 | + |
| 43 | *buf = p + e; |
| 44 | return e; |
| 45 | } |
| 46 | diff --git a/src/journal/test-journal-syslog.c b/src/journal/test-journal-syslog.c |
| 47 | index 9ba86f6c8a..05f759817e 100644 |
| 48 | --- a/src/journal/test-journal-syslog.c |
| 49 | +++ b/src/journal/test-journal-syslog.c |
| 50 | @@ -5,8 +5,8 @@ |
| 51 | #include "macro.h" |
| 52 | #include "string-util.h" |
| 53 | |
| 54 | -static void test_syslog_parse_identifier(const char* str, |
| 55 | - const char *ident, const char*pid, int ret) { |
| 56 | +static void test_syslog_parse_identifier(const char *str, |
| 57 | + const char *ident, const char *pid, int ret) { |
| 58 | const char *buf = str; |
| 59 | _cleanup_free_ char *ident2 = NULL, *pid2 = NULL; |
| 60 | int ret2; |
| 61 | @@ -21,7 +21,13 @@ static void test_syslog_parse_identifier(const char* str, |
| 62 | int main(void) { |
| 63 | test_syslog_parse_identifier("pidu[111]: xxx", "pidu", "111", 11); |
| 64 | test_syslog_parse_identifier("pidu: xxx", "pidu", NULL, 6); |
| 65 | + test_syslog_parse_identifier("pidu: xxx", "pidu", NULL, 7); |
| 66 | test_syslog_parse_identifier("pidu xxx", NULL, NULL, 0); |
| 67 | + test_syslog_parse_identifier(":", "", NULL, 1); |
| 68 | + test_syslog_parse_identifier(": ", "", NULL, 3); |
| 69 | + test_syslog_parse_identifier("pidu:", "pidu", NULL, 5); |
| 70 | + test_syslog_parse_identifier("pidu: ", "pidu", NULL, 6); |
| 71 | + test_syslog_parse_identifier("pidu : ", NULL, NULL, 0); |
| 72 | |
| 73 | return 0; |
| 74 | } |
| 75 | -- |
| 76 | 2.11.0 |
| 77 | |