Package: passwdqc
Version: 1.3.0-1.1
Severity: normal
Tags: patch
Hi,
With a pam configuration like:
password required pam_passwdqc.so min=disabled,8,8,7,7 retry=1 non-unix
random=32 enforce=users
The passwdqc module fails with a segmentation fault. This is because,
in non-unix mode, pam_sm_chauthtok builds up a fake "struct passwd" on
the stack:
if (params.pam.flags & F_NON_UNIX) {
pw = &fake_pw;
pw->pw_name = (char *)user;
pw->pw_gecos = "";
} ...
But doesn't initialize "pw->pw_dir", which is used later in passwdqc_check:
if (pw) {
if (!(u_name = unify(NULL, pw->pw_name)) ||
!(u_gecos = unify(NULL, pw->pw_gecos)) ||
!(u_dir = unify(NULL, pw->pw_dir)))
...
The below patch fixes the problem.
Jim
--- a/pam_passwdqc.c
+++ b/pam_passwdqc.c
@@ -305,6 +305,7 @@ PAM_EXTERN int pam_sm_chauthtok(pam_hand
pw = &fake_pw;
pw->pw_name = (char *)user;
pw->pw_gecos = "";
+ pw->pw_dir = "";
} else {
/* As currently implemented, we don't avoid timing leaks for valid vs. not
* usernames and hashes. Normally, the username would have already been
-- System Information:
Debian Release: stretch/sid
APT prefers testing
APT policy: (250, 'testing'), (200, 'stable'), (50, 'unstable'), (1,
'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 4.6.0-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Init: systemd (via /run/systemd/system)
Versions of packages passwdqc depends on:
ii libc6 2.22-11
ii libpasswdqc0 1.3.0-1.1
passwdqc recommends no packages.
passwdqc suggests no packages.
-- no debconf information
