| Summary: | sys-libs/musl: stack-based buffer overflow in ipv6 literal parsing | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED INVALID | ||
| Severity: | normal | CC: | blueness, lu_zero, toolchain |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://www.openwall.com/lists/oss-security/2015/03/30/3 | ||
| Whiteboard: | B2 [upstream/ebuild] | ||
| Package list: | Runtime testing required: | --- | |
No affected version is in the tree anymore. (In reply to Felix Janda from comment #1) > No affected version is in the tree anymore. Thank you for following up on this. You are correct closing. |
From ${URL} : A stack-based buffer overflow has been found in musl libc's ipv6 address literal parsing code. Programs which call the inet_pton or getaddrinfo function with AF_INET6 or AF_UNSPEC and untrusted address strings are affected. Successful exploitation yields control of the return address. Having enabled stack protector at the application level does not mitigate the issue. All users should patch or upgrade. Software: musl libc (http://www.musl-libc.org) Severity: high Affected Versions: 0.9.15 - 1.0.4, 1.1.0 - 1.1.7. Bug introduced in commit: 78f889153167452de4cbced921f6428b3d4f663a Bug fixed in commit: fc13acc3dcb5b1f215c007f583a63551f6a71363 Patch: musl_dn_expand_overflow_fix.diff (attached) (fix+hardening) diff --git a/src/network/inet_pton.c b/src/network/inet_pton.c index 4496b47..d36c368 100644 --- a/src/network/inet_pton.c +++ b/src/network/inet_pton.c @@ -39,14 +39,15 @@ int inet_pton(int af, const char *restrict s, void *restrict a0) for (i=0; ; i++) { if (s[0]==':' && brk<0) { brk=i; - ip[i]=0; + ip[i&7]=0; if (!*++s) break; + if (i==7) return 0; continue; } for (v=j=0; j<4 && (d=hexval(s[j]))>=0; j++) v=16*v+d; if (j==0) return 0; - ip[i] = v; + ip[i&7] = v; if (!s[j] && (brk>=0 || i==7)) break; if (i==7) return 0; if (s[j]!=':') { @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.