From d42eed4a044e5e10dfb885cf9891c2518a72a491 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Mon, 27 Feb 2017 19:05:13 +0100 Subject: sunrpc: Avoid use-after-free read access in clntudp_call [BZ #21115] After commit bc779a1a5b3035133024b21e2f339fe4219fb11c (CVE-2016-4429: sunrpc: Do not use alloca in clntudp_call [BZ #20112]), ancillary data is stored on the heap, but it is accessed after it has been freed. The test case must be run under a heap debugger such as valgrind to observe the invalid access. A malloc implementation which immediately calls munmap on free would catch this bug as well. --- ChangeLog | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'ChangeLog') diff --git a/ChangeLog b/ChangeLog index eeccfed101..a64fff8c6b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,11 @@ +2017-02-27 Florian Weimer + + [BZ #21115] + * sunrpc/clnt_udp.c (clntudp_call): Free ancillary data later. + * sunrpc/Makefile (tests): Add tst-udp-error. + (tst-udp-error): Link against libc.so explicitly. + * sunrpc/tst-udp-error: New file. + 2017-02-25 Zack Weinberg * sysdeps/generic/math_private.h: Use __BIG_ENDIAN and -- cgit v1.2.3