[SECURITY] Prevent rhostname array overflow
#2
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
be the case that `vallen >= len + sizeof(rhostname)`. This PR fixes the check so the `rhostname` array does not overflow. Reported-by: Github Security Lab <[email protected]> Signed-off-by: Alvaro Muñoz <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is an automatically generated security fix for a vulnerability detected in your code which is a variant of CVE-2020-8597.
You can read in more detail about this vulnerability in CERT Advisory VU#782301.
The vulnerability occurs because, given that
vallenwas checked to be less thanlen, it can never be the case thatvallen >= len + sizeof(rhostname). Therefore,rhostnamenever gets trimmed and therhostnamearray may overflow.While this PR was generated for your project automatically, the supporting analysis was performed and verified by the GitHub Security Lab.
The original finding was reported by Ilja Van Sprundel from IOActive.
The proposed patch was developed by Paul Mackerras (paulusmack) from the Samba project in
paulusmack/ppp@8d7970b#diff-b7f5f2404cf3f5c09b1f8ad9364bb340.
The original vulnerability got assigned CVE-2020-8597 which has a CVSS v3.1 Base Score of 9.8/10.
Source
The source code that generated and submitted this PR is based on JLLeitschuh/bulk-security-pr-generator.
Opting-Out
This bot will respect the ROBOTS.txt format. If you'd like to opt-out of any future automated security vulnerability fixes like this, please consider adding a file called
.github/GH-ROBOTS.txtto your repository with the line:'''
User-agent: GSL/bulk-security-pr-generator
Disallow: *
'''
Alternatively, if this project is no longer actively maintained, consider archiving the repository.
CLA Requirements
This section is only relevant if your project requires contributors to sign a Contributor License Agreement (CLA) for external contributions.
It is unlikely that we will be able to directly sign CLAs. However, all contributed commits are already automatically signed-off.
If signing your organization's CLA is a strict-requirement for merging this contribution, please feel free to close this PR.