diff options
Diffstat (limited to 'meta/recipes-core/systemd/systemd/0025-journald-set-a-limit-on-the-number-of-fields-1k.patch')
-rw-r--r-- | meta/recipes-core/systemd/systemd/0025-journald-set-a-limit-on-the-number-of-fields-1k.patch | 56 |
1 files changed, 56 insertions, 0 deletions
diff --git a/meta/recipes-core/systemd/systemd/0025-journald-set-a-limit-on-the-number-of-fields-1k.patch b/meta/recipes-core/systemd/systemd/0025-journald-set-a-limit-on-the-number-of-fields-1k.patch new file mode 100644 index 0000000000..50a01efe8f --- /dev/null +++ b/meta/recipes-core/systemd/systemd/0025-journald-set-a-limit-on-the-number-of-fields-1k.patch | |||
@@ -0,0 +1,56 @@ | |||
1 | From 4566aaf97f5b4143b930d75628f3abc905249dcd Mon Sep 17 00:00:00 2001 | ||
2 | From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl> | ||
3 | Date: Wed, 5 Dec 2018 22:45:02 +0100 | ||
4 | Subject: [PATCH] journald: set a limit on the number of fields (1k) | ||
5 | |||
6 | We allocate a iovec entry for each field, so with many short entries, | ||
7 | our memory usage and processing time can be large, even with a relatively | ||
8 | small message size. Let's refuse overly long entries. | ||
9 | |||
10 | CVE-2018-16865 | ||
11 | https://bugzilla.redhat.com/show_bug.cgi?id=1653861 | ||
12 | |||
13 | What from I can see, the problem is not from an alloca, despite what the CVE | ||
14 | description says, but from the attack multiplication that comes from creating | ||
15 | many very small iovecs: (void* + size_t) for each three bytes of input message. | ||
16 | |||
17 | Patch backported from systemd master at | ||
18 | 052c57f132f04a3cf4148f87561618da1a6908b4. | ||
19 | --- | ||
20 | src/basic/journal-importer.h | 3 +++ | ||
21 | src/journal/journald-native.c | 5 +++++ | ||
22 | 2 files changed, 8 insertions(+) | ||
23 | |||
24 | diff --git a/src/basic/journal-importer.h b/src/basic/journal-importer.h | ||
25 | index f49ce734a1..c4ae45d32d 100644 | ||
26 | --- a/src/basic/journal-importer.h | ||
27 | +++ b/src/basic/journal-importer.h | ||
28 | @@ -16,6 +16,9 @@ | ||
29 | #define DATA_SIZE_MAX (1024*1024*768u) | ||
30 | #define LINE_CHUNK 8*1024u | ||
31 | |||
32 | +/* The maximum number of fields in an entry */ | ||
33 | +#define ENTRY_FIELD_COUNT_MAX 1024 | ||
34 | + | ||
35 | struct iovec_wrapper { | ||
36 | struct iovec *iovec; | ||
37 | size_t size_bytes; | ||
38 | diff --git a/src/journal/journald-native.c b/src/journal/journald-native.c | ||
39 | index 5ff22a10af..951d092053 100644 | ||
40 | --- a/src/journal/journald-native.c | ||
41 | +++ b/src/journal/journald-native.c | ||
42 | @@ -140,6 +140,11 @@ static int server_process_entry( | ||
43 | } | ||
44 | |||
45 | /* A property follows */ | ||
46 | + if (n > ENTRY_FIELD_COUNT_MAX) { | ||
47 | + log_debug("Received an entry that has more than " STRINGIFY(ENTRY_FIELD_COUNT_MAX) " fields, ignoring entry."); | ||
48 | + r = 1; | ||
49 | + goto finish; | ||
50 | + } | ||
51 | |||
52 | /* n existing properties, 1 new, +1 for _TRANSPORT */ | ||
53 | if (!GREEDY_REALLOC(iovec, m, | ||
54 | -- | ||
55 | 2.11.0 | ||
56 | |||