From e1554d7996a59bf69544f3d8dd4ae683027948f9 Mon Sep 17 00:00:00 2001 From: Hitendra Prajapati Date: Tue, 15 Nov 2022 09:17:18 +0530 Subject: [PATCH] CVE-2022-43995 Upstream-Status: Backport [https://github.com/sudo-project/sudo/commit/bd209b9f16fcd1270c13db27ae3329c677d48050] CVE: CVE-2022-43995 Signed-off-by: Hitendra Prajapati Potential heap overflow for passwords < 8 characters. Starting with sudo 1.8.0 the plaintext password buffer is dynamically sized so it is not safe to assume that it is at least 9 bytes in size. Found by Hugo Lefeuvre (University of Manchester) with ConfFuzz. --- plugins/sudoers/auth/passwd.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/plugins/sudoers/auth/passwd.c b/plugins/sudoers/auth/passwd.c index 03c7a16..76a7824 100644 --- a/plugins/sudoers/auth/passwd.c +++ b/plugins/sudoers/auth/passwd.c @@ -63,7 +63,7 @@ sudo_passwd_init(struct passwd *pw, sudo_auth *auth) int sudo_passwd_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_conv_callback *callback) { - char sav, *epass; + char des_pass[9], *epass; char *pw_epasswd = auth->data; size_t pw_len; int matched = 0; @@ -75,12 +75,12 @@ sudo_passwd_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_c /* * Truncate to 8 chars if standard DES since not all crypt()'s do this. - * If this turns out not to be safe we will have to use OS #ifdef's (sigh). */ - sav = pass[8]; pw_len = strlen(pw_epasswd); - if (pw_len == DESLEN || HAS_AGEINFO(pw_epasswd, pw_len)) - pass[8] = '\0'; + if (pw_len == DESLEN || HAS_AGEINFO(pw_epasswd, pw_len)) { + strlcpy(des_pass, pass, sizeof(des_pass)); + pass = des_pass; + } /* * Normal UN*X password check. @@ -88,7 +88,6 @@ sudo_passwd_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_c * only compare the first DESLEN characters in that case. */ epass = (char *) crypt(pass, pw_epasswd); - pass[8] = sav; if (epass != NULL) { if (HAS_AGEINFO(pw_epasswd, pw_len) && strlen(epass) == DESLEN) matched = !strncmp(pw_epasswd, epass, DESLEN); -- 2.25.1