From owner-freebsd-security@freebsd.org Wed Sep 30 22:04:45 2015 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id A53DAA0CCEB for ; Wed, 30 Sep 2015 22:04:45 +0000 (UTC) (envelope-from delphij@delphij.net) Received: from anubis.delphij.net (anubis.delphij.net [64.62.153.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "anubis.delphij.net", Issuer "StartCom Class 1 Primary Intermediate Server CA" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4CF8212BA; Wed, 30 Sep 2015 22:04:45 +0000 (UTC) (envelope-from delphij@delphij.net) Received: from zeta.ixsystems.com (unknown [12.229.62.2]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by anubis.delphij.net (Postfix) with ESMTPSA id C71C524F75; Wed, 30 Sep 2015 15:04:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=delphij.net; s=anubis; t=1443650684; x=1443665084; bh=6dF7RgvtygX/RWg88dVmCmwZPO2dSKoh2rQ9cWMsqdI=; h=Reply-To:Subject:References:To:Cc:From:Date:In-Reply-To; b=SXozQHPvuFGQofdmcQlsDt/GYQKMJdbxwLn3oroICMQQd74EUZEHR6hbG9vQL2sSx ZO3ejRDlfJdB/bbggd5wVDnvF6Oop+sC1oM4LdYAjwF6eNCCxfuiAE3JJi7SpUn1cB TKsX+UMwa1H/6LDu0v2FMIqHEY8Ke7HB/8z3vldg= Reply-To: d@delphij.net Subject: Re: FreeBSD Security Advisory FreeBSD-SA-15:24.rpcbind References: <20150929183942.569F311FD@freefall.freebsd.org> <560C33B7.70100@delphij.net> <560C39B3.1020806@delphij.net> <560C3DF2.5070608@delphij.net> <20BCBD1F-D22E-4878-AB6C-CBE9F7FD4BF2@inoc.net> <560C426B.1000608@delphij.net> To: Robert Blayzor , d@delphij.net Cc: freebsd-security@freebsd.org, Alfred Perlstein , Hiroki Sato , Rick Macklem , Doug Rabson From: Xin Li X-Enigmail-Draft-Status: N1110 Organization: The FreeBSD Project Message-ID: <560C5C79.3080308@delphij.net> Date: Wed, 30 Sep 2015 15:04:41 -0700 MIME-Version: 1.0 In-Reply-To: <560C426B.1000608@delphij.net> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="fn22nMNXA4eqIrnbk3L0bS4nrJMc8Pb4c" X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Sep 2015 22:04:45 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --fn22nMNXA4eqIrnbk3L0bS4nrJMc8Pb4c Content-Type: multipart/mixed; boundary="------------040300060705050704010101" This is a multi-part message in MIME format. --------------040300060705050704010101 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 09/30/15 13:13, Xin Li wrote: > On 09/30/15 13:03, Robert Blayzor wrote: >> On Sep 30, 2015, at 3:54 PM, Xin Li wrote: >>> >>> Can you make this change and see if it helps? >>> >>> Index: rpcb_svc_com.c >>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>> --- rpcb_svc_com.c (revision 288421) >>> +++ rpcb_svc_com.c (working copy) >>> @@ -1052,7 +1052,7 @@ static bool_t >>> netbuf_copybuf(struct netbuf *dst, const struct netbuf *src) >>> { >>> >>> - assert(dst->buf =3D=3D NULL); >>> + assert(dst->len =3D=3D 0 || dst->buf =3D=3D NULL); >> =85 >> >> >> Same result: >> >> >> Assertion failed: (dst->len =3D=3D 0 || dst->buf =3D=3D NULL), functio= n netbuf_copybuf, file rpcb_svc_com.c, line 1056. >=20 > Hmm this suggests there were either a use-after-free or a memory leak > with existing code. I will need some time to further investigate this.= >=20 > In the meantime, please comment out the assertion (which turns the cras= h > back into memory leak in the worst case). Please try the attached patch, which will reallocate buffer only when the passed in netbuf is of a different size. Cheers, --=20 Xin LI https://www.delphij.net/ FreeBSD - The Power to Serve! Live free or die --------------040300060705050704010101 Content-Type: text/x-patch; name="rpcbind.diff" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="rpcbind.diff" Index: usr.sbin/rpcbind/rpcb_svc_com.c =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --- usr.sbin/rpcbind/rpcb_svc_com.c (revision 288421) +++ usr.sbin/rpcbind/rpcb_svc_com.c (working copy) @@ -1052,12 +1052,15 @@ static bool_t netbuf_copybuf(struct netbuf *dst, const struct netbuf *src) { =20 - assert(dst->buf =3D=3D NULL); + if (dst->len !=3D src->len || dst->buf =3D=3D NULL) { + if (dst->buf !=3D NULL) + free(dst->buf); + if ((dst->buf =3D malloc(src->len)) =3D=3D NULL) + return (FALSE); =20 - if ((dst->buf =3D malloc(src->len)) =3D=3D NULL) - return (FALSE); + dst->maxlen =3D dst->len =3D src->len; + } =20 - dst->maxlen =3D dst->len =3D src->len; memcpy(dst->buf, src->buf, src->len); return (TRUE); } --------------040300060705050704010101-- --fn22nMNXA4eqIrnbk3L0bS4nrJMc8Pb4c Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.1.8 (FreeBSD) iQIcBAEBCgAGBQJWDFx5AAoJEJW2GBstM+nsQD8QAI0HEadIYoHUbcrajcx+gNF7 uiK5a4eRhELVg5uB5vhq/CsVQxHQfStMt+biTa7rDO2JkZDoU3g0BvY0BbwQnYr4 veXd/QvE26kdBOR6poR8dSrpCwtrT/Og/ZHvZQzT88pKngUP6xYJJ3t+dKD9r4v8 tVxZm3kJhiDu7KNLb6YXUGJnK+3UCJagdNHRZX7ZPDqpFmiOs0yiZ845SK0KrtT+ NSRB1NDWPkpEHLhQdtN+GsC2eeMw7jP44W1DtMXilYgd7+eJtbuaDIL9l+ZruJj7 8wAzuw+gQ0ZbfVwz7pWs8BJxH3Rd4nxmZPgdx0oEItBkWxuoSTgYQZlhUnhnOnaM 9cuNIDFjGmIcXR21D6mgGlYBG7hEYXgYty979rVE7cW25I5D7cMt9sDAi3FibI3R FbHWr1EDZHvBhdqTx1tZIwn7XfLVajKFB/KLlh+sAyExlyfplyaRrwTZRyTIVFVu 1Gxinh/1e/FRBe2exM/wsv8fgR+rQsZdHzWbKw1kl4pl+gSWv2Ut3pGrXIyMix58 Vl2JrFtXFhFWJ3cXWDrJS49gHCXtoEQ164lowXjt++2lWsb//b9PVsp6IVmAh0RN UXQsWSdQtpdlQl30S2OPjPBbmDMPMo1SlIl2M6mlY87IYjfXfTZUtUw5Kfq7UKjH u/iNxQ64D9Awh9bmvH0z =6ZWK -----END PGP SIGNATURE----- --fn22nMNXA4eqIrnbk3L0bS4nrJMc8Pb4c--