Public bug reported: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
affects ubuntu/cron When a hostname fills cron's fixed-size buffer, the job-output mail path can treat it as a NUL-terminated string even though gethostname() did not provide a terminator. An AddressSanitizer harness reproduced an out-of-bounds read. This requires a maximum-length administrator-controlled hostname, job output, and mail delivery. A useful information leak or production crash has not been demonstrated. The intended fix reserves space for termination, checks gethostname()'s result, and uses a fallback on error. Debian report with the issue-specific patch and regression test: https://bugs.debian.org/1152899 The patched Ubuntu source passed a focused regression in a disposable container; the Debian patched source built and passed its existing integration suite. Ubuntu and Debian Security Teams recommended public bug reports for these findings. Please consider the fix for Ubuntu and supported-release backports as appropriate. Brett Sutton -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQT9urELYHGjhO/7gF+TZqY73ysXxAUCauk/EwAKCRCTZqY73ysX xAb0AQCRO1yVkVsscZ7U2ElCjAokZwKu4xDA+BNugxCsJ1hQxgD/RXgrXnoskG8x pDXlAGOw5P/8Lu2Fkek5v/LR9rJg3gY= =tHd+ -----END PGP SIGNATURE----- ** Affects: cron (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172794 Title: cron mail hostname handling can read past a full buffer To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cron/+bug/2172794/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
