Re: [systemd-devel] [PATCH] ask-password: prevent buffer overrow when reading from keyring

[Lennart Poettering]

On Mo, 13.05.19 16:58, Thadeu Lima de Souza Cascardo (casca...@canonical.com) 
wrote:

> When we read from keyring, a temporary buffer is allocated in order to
> determine the size needed for the entire data. However, when zeroing that 
> area,
> we use the data size returned by the read instead of the lesser size allocate
> for the buffer.
>
> That will cause memory corruption that causes systemd-cryptsetup to crash
> either when a single large password is used or when multiple passwords have
> already been pushed to the keyring.
>
> Signed-off-by: Thadeu Lima de Souza Cascardo
> 

Converted to a github PR:

https://github.com/systemd/systemd/pull/12566

Looks great! Thanks!

Lennart

--
Lennart Poettering, Berlin
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/systemd-devel

Re: [systemd-devel] [PATCH] ask-password: prevent buffer overrow when reading from keyring

[systemd github import bot]

Patchset imported to github.
To create a pull request, one of the main developers has to initiate one via:


--
Generated by https://github.com/haraldh/mail2git
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/systemd-devel

[systemd-devel] [PATCH] ask-password: prevent buffer overrow when reading from keyring

[Thadeu Lima de Souza Cascardo]

When we read from keyring, a temporary buffer is allocated in order to
determine the size needed for the entire data. However, when zeroing that area,
we use the data size returned by the read instead of the lesser size allocate
for the buffer.

That will cause memory corruption that causes systemd-cryptsetup to crash
either when a single large password is used or when multiple passwords have
already been pushed to the keyring.

Signed-off-by: Thadeu Lima de Souza Cascardo 
---
 src/shared/ask-password-api.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/shared/ask-password-api.c b/src/shared/ask-password-api.c
index ab0c34692f1c..6c0a36990291 100644
--- a/src/shared/ask-password-api.c
+++ b/src/shared/ask-password-api.c
@@ -80,7 +80,7 @@ static int retrieve_key(key_serial_t serial, char ***ret) {
 if (n < m)
 break;
 
-explicit_bzero_safe(p, n);
+explicit_bzero_safe(p, m);
 
 if (m > LONG_MAX / 2) /* overflow check */
 return -ENOMEM;
-- 
2.20.1

___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/systemd-devel