Advisory: https://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8#advisory-comment-72243 "Modules for TCP syslog reception have a heap buffer overflow when octet-counted framing is used. The attacker can corrupt heap values, leading to data integrity issues and availability impact. Remote code execution is unlikely to happen but not impossible."
Please bump to 8.2204.1.
(In reply to Sam James from comment #1) > Please bump to 8.2204.1. Ping.
(In reply to Sam James from comment #2) > (In reply to Sam James from comment #1) > > Please bump to 8.2204.1. > > Ping. Oh, I guess we could stable 8.2206.0, but that's a big jump.
(In reply to Sam James from comment #3) > (In reply to Sam James from comment #2) > > (In reply to Sam James from comment #1) > > > Please bump to 8.2204.1. > > > > Ping. > > Oh, I guess we could stable 8.2206.0, but that's a big jump. Yup, it was just added.
(In reply to Maciej Barć from comment #4) > (In reply to Sam James from comment #3) > > (In reply to Sam James from comment #2) > > > (In reply to Sam James from comment #1) > > > > Please bump to 8.2204.1. > > > > > > Ping. > > > > Oh, I guess we could stable 8.2206.0, but that's a big jump. > > Yup, it was just added. Sorry, what I mean is: do you really want to stable that version? You can if you want, but I'd suggest adding 8.2204.1 and doing that instead. But I don't know much about upstream. If not much changed, then go wild. Just better to do more conservative versions for fast/security stabilisation.
commit 0e67541db4cc7e5069e1f7aca15d3c8372f4ba90 Author: Maciej Barć <xgqt@gentoo.org> Date: Mon Feb 13 23:15:49 2023 +0100 app-admin/rsyslog: drop old 8.2102.0-r1
To see the correction, open the diff file at: http://http.us.debian.org/debian/pool/main/l/l2tpd/l2tpd_0.70-pre20031121-2.diff.gz https://phrazle.co but it's applied to a 0.70_pre version they got from l2tpd repository. It might be sufficient to take the following and apply it to control.c : ------------------------------------------------ wbuf[pos++] = e; for (x = 0; x < buf->len; x++) { + // we must at least still have 4 bytes left in the worst case scenario: + // 1 for a possible escape, 1 for the value and 1 to end the PPP stream. + if(pos >= (sizeof(wbuf) - 4)) { + if(DEBUG) + log(LOG_CRIT, "%s: rx packet is too big after PPP encoding (size %u, max is %u)\n", + __FUNCTION__, buf->len, MAX_RECV_SIZE); + return -EINVAL; + } e = *((char *) buf->start + x); if ((e < 0x20) || (e == PPP_ESCAPE) || (e == PPP_FLAG)) Data integrity and availability may be compromised if an attacker is able to alter heap values. It is quite improbable that remote code execution would occur, but it is still conceivable.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=f455f9d7512e81d045be14e7088324e24a7cb281 commit f455f9d7512e81d045be14e7088324e24a7cb281 Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2024-08-11 14:42:54 +0000 Commit: Hans de Graaff <graaff@gentoo.org> CommitDate: 2024-08-11 14:43:01 +0000 [ GLSA 202408-28 ] rsyslog: Heap Buffer Overflow Bug: https://bugs.gentoo.org/842846 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: Hans de Graaff <graaff@gentoo.org> glsa-202408-28.xml | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+)
