1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
|
From 2c933ecba3bb1d3041a5a7a53a7b4078a6003413 Mon Sep 17 00:00:00 2001
From: Craig Small <csmall@dropbear.xyz>
Date: Thu, 10 Aug 2023 21:18:38 +1000
Subject: [PATCH] ps: Fix possible buffer overflow in -C option
ps allocates memory using malloc(length of arg * len of struct).
In certain strange circumstances, the arg length could be very large
and the multiplecation will overflow, allocating a small amount of
memory.
Subsequent strncpy() will then write into unallocated memory.
The fix is to use calloc. It's slower but this is a one-time
allocation. Other malloc(x * y) calls have also been replaced
by calloc(x, y)
References:
https://www.freelists.org/post/procps/ps-buffer-overflow-CVE-20234016
https://nvd.nist.gov/vuln/detail/CVE-2023-4016
https://gitlab.com/procps-ng/procps/-/issues/297
https://bugs.debian.org/1042887
Signed-off-by: Craig Small <csmall@dropbear.xyz>
CVE: CVE-2023-4016
Upstream-Status: Backport [https://gitlab.com/procps-ng/procps/-/commit/2c933ecba3bb1d3041a5a7a53a7b4078a6003413]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
NEWS | 1 +
ps/parser.c | 8 ++++----
2 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/NEWS b/NEWS
index b9509734..64fa3da8 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,5 @@
+ * ps: Fix buffer overflow in -C option CVE-2023-4016 Debian #1042887, issue #297
+
procps-ng-3.3.16
----------------
* library: Increment to 8:2:0
diff --git a/ps/parser.c b/ps/parser.c
index 248aa741..15873dfa 100644
--- a/ps/parser.c
+++ b/ps/parser.c
@@ -184,7 +184,6 @@ static const char *parse_list(const char *arg, const char *(*parse_fn)(char *, s
const char *err; /* error code that could or did happen */
/*** prepare to operate ***/
node = malloc(sizeof(selection_node));
- node->u = malloc(strlen(arg)*sizeof(sel_union)); /* waste is insignificant */
node->n = 0;
buf = strdup(arg);
/*** sanity check and count items ***/
@@ -205,6 +204,7 @@ static const char *parse_list(const char *arg, const char *(*parse_fn)(char *, s
} while (*++walk);
if(need_item) goto parse_error;
node->n = items;
+ node->u = calloc(items, sizeof(sel_union));
/*** actually parse the list ***/
walk = buf;
while(items--){
@@ -1031,15 +1031,15 @@ static const char *parse_trailing_pids(void){
thisarg = ps_argc - 1; /* we must be at the end now */
pidnode = malloc(sizeof(selection_node));
- pidnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */
+ pidnode->u = calloc(i, sizeof(sel_union)); /* waste is insignificant */
pidnode->n = 0;
grpnode = malloc(sizeof(selection_node));
- grpnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */
+ grpnode->u = calloc(i,sizeof(sel_union)); /* waste is insignificant */
grpnode->n = 0;
sidnode = malloc(sizeof(selection_node));
- sidnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */
+ sidnode->u = calloc(i, sizeof(sel_union)); /* waste is insignificant */
sidnode->n = 0;
while(i--){
--
GitLab
|
