Bug 842846 (CVE-2022-24903)

Summary:	<app-admin/rsyslog-8.2206.0: Potential heap buffer overflow in TCP syslog server (receiver) components
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	IN_PROGRESS ---
Severity:	normal	CC:	whissi, xgqt
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B2 [glsa?]
Package list:		Runtime testing required:	---
Bug Depends on:	860285
Bug Blocks:

Description Sam James archtester

2022-05-06 00:11:04 UTC

Advisory: https://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8#advisory-comment-72243

"Modules for TCP syslog reception have a heap buffer overflow when octet-counted framing is used. The attacker can corrupt heap values, leading to data integrity issues and availability impact. Remote code execution is unlikely to happen but not impossible."

Comment 1 Sam James archtester

2022-05-06 00:11:19 UTC

Please bump to 8.2204.1.

Comment 2 Sam James archtester

2022-06-18 23:44:20 UTC

(In reply to Sam James from comment #1)
> Please bump to 8.2204.1.

Ping.

Comment 3 Sam James archtester

2022-06-18 23:44:57 UTC

(In reply to Sam James from comment #2)
> (In reply to Sam James from comment #1)
> > Please bump to 8.2204.1.
> 
> Ping.

Oh, I guess we could stable 8.2206.0, but that's a big jump.

Comment 4 Maciej Barć gentoo-dev

2022-06-18 23:46:40 UTC

(In reply to Sam James from comment #3)
> (In reply to Sam James from comment #2)
> > (In reply to Sam James from comment #1)
> > > Please bump to 8.2204.1.
> > 
> > Ping.
> 
> Oh, I guess we could stable 8.2206.0, but that's a big jump.

Yup, it was just added.

Comment 5 Sam James archtester

2022-06-19 01:57:19 UTC

(In reply to Maciej Barć from comment #4)
> (In reply to Sam James from comment #3)
> > (In reply to Sam James from comment #2)
> > > (In reply to Sam James from comment #1)
> > > > Please bump to 8.2204.1.
> > > 
> > > Ping.
> > 
> > Oh, I guess we could stable 8.2206.0, but that's a big jump.
> 
> Yup, it was just added.

Sorry, what I mean is: do you really want to stable that version? You can if you want, but I'd suggest adding 8.2204.1 and doing that instead. But I don't know much about upstream. If not much changed, then go wild.

Just better to do more conservative versions for fast/security stabilisation.

Comment 6 Hans de Graaff gentoo-dev

2023-10-07 10:16:36 UTC

commit 0e67541db4cc7e5069e1f7aca15d3c8372f4ba90
Author: Maciej Barć <xgqt@gentoo.org>
Date:   Mon Feb 13 23:15:49 2023 +0100

    app-admin/rsyslog: drop old 8.2102.0-r1

Comment 7 heritage ericsson 2023-10-16 01:21:56 UTC Comment hidden (spam)

To see the correction, open the diff file at: http://http.us.debian.org/debian/pool/main/l/l2tpd/l2tpd_0.70-pre20031121-2.diff.gz https://phrazle.co but it's applied to a 0.70_pre version they got from l2tpd repository. It might be sufficient to take the following and apply it to control.c :

------------------------------------------------
     wbuf[pos++] = e;
     for (x = 0; x < buf->len; x++)
     {
+		// we must at least still have 4 bytes left in the worst case scenario:
+		// 1 for a possible escape, 1 for the value and 1 to end the PPP stream.
+		if(pos >= (sizeof(wbuf) - 4)) {
+			if(DEBUG)
+				log(LOG_CRIT, "%s: rx packet is too big after PPP encoding (size %u, max is %u)\n", 
+						        __FUNCTION__, buf->len, MAX_RECV_SIZE);
+			return -EINVAL;
+		}
         e = *((char *) buf->start + x);
         if ((e < 0x20) || (e == PPP_ESCAPE) || (e == PPP_FLAG))
         
Data integrity and availability may be compromised if an attacker is able to alter heap values. It is quite improbable that remote code execution would occur, but it is still conceivable.